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(57) Abstract: A "personalized" computer with a unique 
digital signature which will not boot up or recognize 
any data storage or communication peripheral devices 
without a matching "personalized" smart card containing 
a complementary encrypted digital signature. A modified 
BIOS (Basic Input Output System) replaces the standard 
BIOS of a motherboard and allows a security engine 
microprocessor to take over preboot control of the 
computer from the motherboard CPU (Central Procesisng 
Unit), configures and operates the encryption-based 
security system, and enables or disables selected data 
storage devices and other user selectable peripherals upon 
start up and shut down of the computer. The enabling or 
disabling of peripheral devices involves the use of special 
enabling/disabling circuits. A modified DDL (Device 
Driver Layer), loaded in the hard drive of the computer 
as part of the resident O/S (Operating System) of the 
computer, and memory buffer circuits allows a real time 
encryption system to be in place for any communication 
or data storage device. A data encryption engine in the 
security engine microprocessor allows encryption and 
decryption of all data stored in data storage devices. 
Upon power up, reset or interrupt of the computer, the 
microprocessor looks for, and if present, reads from the 
smart card in the smart card reader which is logically 
connected to the security engine microprocessor. This 
invention can also be used to allow identification and 
authentication of the computer and its user in networks. 
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PREBOOT PROTECTION, IDENTIFICATION AND SECURITY OF A COMPUTER SYSTEM 

CROSS-REFERENCE TO RELATED APPLICATIONS 
Not Applicable 

STATEMENT REGARDING FEDERALLY SPONSORED REASEARCH OR DEVELOPMENT 

Not Applicable 

REFERENCE TO A MICROFICHE APPENDIX 
Not Applicable 

TECHNICAL FIELD OF THE INVENTION 

The present invention pertains generally to computer security systems, and more spccincally to a microprocessor based 
system to restrict access to a particular computer and deter its theft and secure stored and transmitted data. 

BACKGROUND OF THE INVENTION 

As the prevalence and importance of computers grows and their portability increases, so too does the need to protect 
these systems and the data stored within them from unauthorized access and theft. These lead to not only financial costs 
through the loss of valuable data, perpetration of fraud and sabotage, and the loss of equipment, but also privacy 
concerns as sensitive information is accessed Without authorization. Unauthorized access becomes even more of an issue 
as the points of access to a computer increase through the use of networks and the Internet. 

A wide variety of methods for preventing theft of computer data and equipment and unauthorized access have been 
developed. One method for securing computers is lo physically secure them with some form of restraint or locking 
device. Typical among these are bolt-down metal enclosures or cable and lock devices which physically secure a 
computer to the floor or a desk. These devices arc effective only as a deterrent lo theft of the hardware and do not 
protect the data stored inside the computer should they be compromised. 

To deter access to sensitive data and theft encryption algorithms have been employed to render the data unintelligible to 
unauthorlz.ed users. While the use of this method can protect the data stored hi the computer il'a secure enough 
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algonthm is used, it is InclTeciive at deternng theft ofthc computer I'lselfas all parts ofihc computer system are still 
fully functioning and require only tiial the encrypted data storage dcvice{s) be replacedv 

To address the problem of physical theft of the computer some security systems employ a means by which the data 
stored hi the computer system such as the in the hard drive is physically or logically destroyed if unauthorized access is 
attempted or the computer is tampered with. Logical destruction of the data also destroys the data for aulliorized users 
and does not affect the functioning of the data storage device. Physical destruction of the hard drive renders the data and 
drive useless for both the unauthorized and authorized user but does not incapacitate the entire system as the drive can 
simply be replaced* 

Another method for securing a computer system, specifically the data stored inside, is the use of identification and 
authentication systems by which a user provides a claimed Identity to the system and establishes the validity of this claim 
before access is granted. The three main methods by which a user's claimed identity is verified are through the use of: 
1 0 something the individual knows such as a password or PIN (Personal Identification Number); 2.) something the 
individual possesses, such as a token - a magnetic stripe card or smart card for example; and/or 3.) something unique to 
the individual, such as a biometric characteristic - retina pattern or fingerprint for example. This method may be 
effective to a certain degree to deter theft or sabotage of data but is relatively ineffective as a deterrent to actual theft of 
the computer. In addition all these identification and authentication systems may be by-passed by such techniques as 
removing the hard drive from the secured machine and placing it in another unsecured machine thereby gaining access to 
the data stored inside or microscopically reading data stored in ROM (Read Only Memory). 

US Patent No. 4,95 1 ,249 to McClung et aL, March 23, 1 989, describes a personal computer security system which 
comprises an expansion card, a magnetic card reader, a tilt detecting means, a tamper detecting means and an alarm. 
This system protects a persona! computer in two ways. The first is the physical protection of the hardware through the 
use of an alarm system which detects attempts to move the computer or tamper with the computer's housing. The second 
method involves the disabling of the keyboard and fioppy drive to prevent the introduction of an unauthorized operating 
system, and the passing of control Immediately prior to the loading of the operating system to a ROM device on the 
security system board which contains Instructions involving the security procedures. One of the main security measures 
IS tlie use oFa magnetic card reader and magnetic card to identify the user of the computer, 7'his system has several 
weaknesses. One weakness is that the expansion card may be simply removed from the computer slot or replaced by 
another. The lack of an intelligent device such as a microprocessor on the security board further adds to this weakness. 
In addition, the passing of control to the security card ROM may be by-passed at the BIOS or pre-boot level through a 
modification of the computer's BIOS. Another problem with this system is the inherent weakness of magnetic stripe 
cards, 'fhcse cards generally lack any intelligent means to prevent copying or reading of the information stored on them. 
Finally, although the tamper alarm may he somewiiat of a deterrent, il'an unauthorized user can gain access to the data 
sioicd in the computer through methods such as the removal of the hard drive, the lack of cncry];>tion security leaves the 
data totally unprotected. 
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US Patent No, 5.146,499, to GenVotin, September 8, 1992 describes a data processing system comprising a pscudo 
random number generating means, a start up detecting microclrcuit, a security microcircuit, and main BUS blocking 
circuit, all connected to a microprocessor and a smart card reader logically connected to the CPU ofthe computen Upon 
start up ofthe computer system, an authentication procedure is executed by the microcircuit board in which identifies 
and authenticates the user through the verification of a smart card involving the comparison of encrypted keys created by 
the random number gencraton Failure oPthis veritlcation procedure results in a continuous blocking signal being sent to 
the main BUS shutting down the start up procedure. This differs from the present invention which uses modified device 
drivers and a number of enable/disable circuits to selectively enable or disable peripherals in the absence of proper 
authorization. Active physical attack ofthe security system described in patent 5, 146,499 is prevented by locating part 
ofthe standard BIOS in the electronic microcircuit. This security system may be circumvented through the removal of 
the security microcircuit board and the reinstallation of a new BIOS in the EPROM CElectrically Programmable Read 
Only Memory) memory ofthe computer systeiiiv In addition, information within data storage devices such as the hard 
drive are not encrypted and therefor can be read by placing these devices in another machine. 

US patent 5,007,082 to M. Cummins April 9, 1991 describes a computer software encryption apparatus which also 
operates during the power on stage ofthe computer start up procedure. This system involves attaching an enci-yption 
algorithm to the computer's BIOS and comprises a fixed data storage medium such as a hard drive, a removable data 
storage medium such as a floppy disk and a buffer area for communicating witii both of these data storage devices. Data 
flowing from the buffer to the removable data storage medium is intercepted and encrypted. Data flowing from the 
removable data storage medium to the buffer is similarly intercepted and decrypted. As a data security system this 
invention has many problems. Perhaps most important is the fact that the information on the Mixed data storage medium' 
such as a hard drive is not encrypted and may be easily accessed by removing the storage device from the 'secure' 
computer and installing it in another computer. Also, the BIOS level software program may be replaced by replacing the 
modified routines stored in the computer's ROM (Read Only Memor>0 with new routines Which do not contain the 
interrupt and encryption functions. Finally, this security system is hardware specillc and must be reconfigured for each 
different type of computer CPU. 

United States patent 5,6 1 0,98 1 to Mooney et aL, March 1 U 1 997 describes a computer access controlling device 
comprising a microprocessor-controlled card reader interface connected to a smart card reader and the CPU ofthe 
computer, "fhe card reader interface includes an encryption engine for encrypting data in a data storage device and a 
boot ROM containing veriHcation code which is executed during tlie start up procedure. Identification and 
authentication ofthe user is achieved through the asking of one or more predetermined questions once a smart card has 
been inserted in the card reader. The responses to these questions are compared to the answers stored on the smart card 
and if they match, the CPU is allowed to access all authorized peripherals. Attempts at unauthorized access will result in 
eitlier freezing ofthe system BUS, or logical or physical destruction of data in data storage devices. This dilTers from the 
present invention in that the Mooney patent will only operate through an ISA (Interrupt Standard Architecture) Bus and 
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therefor is not suitable for computer systems with the PCI (Peripheral Component interconnect) i3us which is in common 
use in many systems. This system is also chipset dependent and must be redesigned fbr every new motherboard 
microprocessor chipset. Logical and particularly physical destruction of data represents an extreme measure and may 
permanently destroy valuable data for authorized userSv In addition, simple freezing of the system BUS may be 
overcome by bypassing the card reader interface board and rebooting the computer. Without a modification to the 
system BIOS this device is also vulnerable during the ROM scan phase of the BIOS start up routine. An expansion card 
with on-board ROM could be used to nitroduce some code which could redirect the computer CPU to perform some 
unauthorized task at the preboot leveK 

US Patent 5 J 87,352 to Wv Blair et al, February 16, 1993 also describes a microprocessor controlled security system for 
computers. This security system involves a microprocessor which reads data from a magnetically encoded card and 
based on component access and time allotment data responsively sends enable or disable signals through a component 
interface circuit to the computer system component(s). The components that can be enabled/disabled are limited to the 
video display device, hard disk drive, and external CPUs of slave computers. The use of magnetically encoded cards 
presents a major weakness in this system as these cards are easily read and copied and therefor are not very secure, 

hi January 1998, Phoenix Technologies Inc. and RSA jointly and publicly announced a preboot security system which 
uses a modified BIOS and encryption engine. In this security system a programmable cipher device or 'cryptoengine' is 
placed in the bootblock partition of flash memory. This flash memory is protected from unauthorized updates by 
password and a token which contains the keyfs) necessary to conduct such as operation^ The security system involves the 
digital signing of adapter cards and ROM extensions for peripheral devices with the peripheral vendor^s private key. 
During the ROM scan phase of the start up procedure of a computer, the BIOS compares a list of authorized public keys 
against the digital signatures of periplieral devices encountered during ROM scan. This requires that all approved 
peripheral devices be digitally signed with the vendor's private encryption key beforehand. Only approved peripheral 
devices are allowed to load and operate. This system is a bit awkward in that all authorized peripheral devices must have 
digital signatures embedded in thein by the device vendor or manufacturer. The system is thus restricted to only those 
vendors or manufacturers who participate in this digital signature process. In addition, as far as can be determined from 
information concerning this system released to date, the Phoenix/RSA system differs from the present invention in that 
peripheral devices are not physically disabled making them accessible and vulnerable to a determined unauthorized user. 

There is a need in the art Ibr a computer security system which is less vulnerable to bypass and which, at the same time, 

deters physical theft of the computer itself l^y rendering it inoperable in the absence ofUhe propoi- authorization and 
identiHcation procedures, 'fhere is a further need to protect the data stored in peripheral data storage devices and which 
is communicated through the computer using a modem or other similar device. There is also a need lor a computer 
Security system which is not limited to any one computer CPU but can work universally with a variety of CPU\^ and 
does also not require unanimous participation of vendors and nianufactiircrs to one particular standard in order to be 
effective. 1'here exists a further need for a system wivich provides a means to identify and auihcnlicate a compulLM- 
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system over a network before allowing it access to the network, in order lo protect the security oftlie network itselFand 
the data stored therein. 


BRIEF SUMMARY OF THE INVENITION 


The present invention overcomes the limitations of the prior art by providing a means for controlling access to a 
computer and sensitive data stored on its data storage devices at (he pre-boot phase and during operation of the 
computer^ The present invention provides a means for identifying and verifying the identity of authorized users through 
smart card identification performed at the BIOS level, the real time protection of sensitive data stored in data storage 
devices and communicated through devices such as a modem with encryption algorithms, restricting access to certain 
peripheral devices of a computer system through the use of individually configured smart cards and computers. It also 
acts as a deterrent to theft by providing the means to incapacitate the computer system by disabling peripheral devices in 
tlie absence of the proper authorization and identification procedure. This invention acts as a deterrent to theft in a 
similar manner to car radio systems which have removable face plates. In the case of this computer security system, the 
knowledge that without tlie proper smart card the computer will not operate, acts a deterrent to would be thieves. The 
invention comprises a modified motherboard with a microprocessor based security engine, enabling and disabling 
circuits, memory buffer circuits, and a modified BIOS, modified DDL, and a smart card reader and smart cards. 

Upon pow^er up or interrupt of the computer, the modified BIOS takes control and allows tlie security engine 
microprocessor to look for, and if present, read from a smart card in the smart card reader which is logically connected 
to the security engine microprocessor. If the smart card and the computer have not been previously 'personalized' a 
security setup procedure is initiated and a unique hash number (digital signature] placed in t\\e smart card during the 
initial set up of the security system and a complementary hash number similarly assigned to the security engine memory. 
The hash number calculations are based on a set of personal information provided by the holder oFa particular smart 
card and thus each computer and smart card is uniquely 'personalized' for that user. During start up or interrupt of the 
computer, a software program in the flash memory of the security engine compares the hash numbers !n the smart card 
and the computer. If these two hash numbers are complements, the boot up procedure is allowed to continue and access 
to the computer allowed up to a predetermined level depending on the level of access configured in the security engine. 
The level of access allowed is determined by the presence or absence of encrypted keys In the memory of the security 
engine which arc required before any device driver can load and initialize and recognize its respective peripheral 
communication or data storage device. This enable and disable capability is achieved through the placement of 
tmablc/disablc circuits between the peripheral device connector and its respective Bus* If the proper smart card is not 
present in the card reader, no device drivei s will be loaded and the computer will not be operable. Provisions arc made 
wilhin this invention to accommodate a hierarchy of users within a computer network and to allow identiilcation and 
authentication procedures over a neh\^ork ol' computers containing the present invention. 


BRIEF DESCRIPTION OF THE DRAWINGS 
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FIG* 1 is a block diagram ofa conipuler nioUierboard according to the cmbodinient of the invcnlionv 

FIG. 2 is a simplified schemaiic diagram oflhe smart card interface. 

FIG- 3 is a simplified sche/?ialic of the programn7ing cfrcuii. 

FIG. 4 is a simplilled schematic ofthe keyboard enablc/disable circuU. 

FIG. 5 is a simplified schematic ofthe COM port enable/disable circuit 

FIGv 6 is a simplified schematic ofthe Parallel port enable/disable circuit 

FIG. 7 is a simplitlcd schematic ofthe floppy drive enable/disable circuit. 

FIG. 8 Is a simplified schematic ofthe ISA slot enable/disable circuit 

FIG. 9 is a simplified schematic ofthe PCI slot enable/disable circuit. 

FIGS. lOA & lOB together comprise a simplified schematic ofthe IDE enable/disable circuit 
FIGS. I 1 A 1 I B show a simplified schematic ofthe ISA circular memory buffer, 
FIG, 12 is a simplified schematic ofthe PCI circular memory butTen 

FIGS. I3A to 13 V together comprise a flow chart that sets forth the set up and operation ofthe invention. 


DETAILED DESCRIPTION OF THE INVENTION 


]n one ejiibodiineni of tJie present invention, a microprocessor security engine, e/iab/e/disable circuits, memory buffer 
circuits, smart card reader interface, modified BIOS, and modified device driver layer are incorporated into the design of 
a standard motherboard to produce a 'security motherboard\ Fig. 1 is a simplified block diagram representing tlie 
implementation of this invention in a motherboard of a personal computer. The major functional components of a typical 
motherboard comprises a CPU 101, a chipset to control all Bus level interactions 103. a system cache 104, memory 107, 
and a BIOS 109. Peripheral devices such as data storage devices, keyboard, mouse, monitoi-, and inodem are logically 
connected to the motherboard CPU through the Bus systems. Peripheral data storage devices such as a hard drive or CD 
ROM drive are connected to the CPU via an IDE interface which is connected to the motherboard main Bus 108 through 
a bridge circuit 1 13. Also connected to the main Bus 108 through the bridge circuit is the ISA Bus 1 15 to which 
peripheral devices such as the keyboard 117, audio, serial port 1 19. parallel port 121, and fioppy drive controller are 
connected. The memory device that contains the BIOS 109 also operates through this Bus. 

Security Engine 

Sv'mbohY^ally represented within dashed fines, tlie Security engine 123 of this invention comprises a microprocessor with 
internal RAM (random access memory) and fiash memory 125 and n scratch memory buffer 127 consisting of SRAM 
(Static Random Access Memory), a programming circuit 129 and independent battery backup circuit I3L 

The baltery backup circuit 131 conneclcd to the microprocessor 125 alJuws the seciiritv' engine 123 to alvvasK have 
auionialic power on during Interrupts such as during manual iv^vis and power lailurcK, This also ensures a secure nnt} 
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proper shut down procedure. This same battery also supplies the SRAM oflhe scratch memory 127. Tiic scratch 
memory 127 is connected to the security engine microprocessor 125 through two lines. These two lines control the How 
ofdatn and address. The amount* ofdata How can easily bo increased through the addition ofniore SRAM, A power 
on/powcr ofT circuit is connected to the microprocessor and tiie computer power supply. This allows the security engine 
to automatically power on during the start up oFthc computer or aller an interrupt. 

The programming circuit 129 is logically connecicd to the security engine microprocessor 123, the security engine 
scratch memory 127, and the smart card reader 133 through the smart card interface 135. The smart card interface 135 is 
shown in Fig. 2 and is comprised oFPAO 136, PBO 138, PB 1 140, PB2 142, PB3 149 and Reset 150 lines which have 
pull down resistors on them, and Clock 152, Ground 154, and (Supply voltage) VGC 156 lines. As shown in Fig. 3, the 
programming circuit is comprised of an IC (integrated circuit) 145 which Is capable of regulating voltage and which is 
powered from the motherboard powder supply, and a TTL (Transistor to transistor logic) latch device 147, The preferred 
IC Is a voltage regulator although one skilled in the art can easily see that other components which perform a similar 
function may be substituted without materially changing the scope or spirit of the invention^ The preferred TTL latch 
device is a transparent latch although one skilled in the art can easily see that other components which perform a similar 
function may be substituted without maienally changing the scope or spirit of the invention. 

The voltage regulator 145 of the programming circuit is connected to the smart card reader 133 through a PB3 line 149 
w^hich is part of the smart card interface 135v A Voltage Programming Power supply (VPP) line 151 connects the 
voltage regulator 145 to the VPP pin of the security engine microprocessor 125. Logically connected to this line is a 
noise filter which is comprised of a grounded capacitor 152 and a grounded resistor 153 for the VPP signal. When this 
VPP line is set to High, the programming circuit 129 is able to burn data into the security engine microprocessor 125 
flash memory. 

The latch device 147 Is logically connected to security engine microprocessor 125 through a multiplicity of data/address 
lines. Between the latch device 147 and the scratch memory 127 are an equal number of address lines. On the 
data/address lines between the security engine microprocessor and the TTL latch device 147, data lines connect the 
address/data lines to the scratch memory 127. The preferred number ofdata lines is eight to sixteen, although one skilled 
in the art can see that the number may vary without materially changing the scope or spirit of this invention. The address 
and data lines between the security engine microprocessor and the scratch memory are multiplexed in order that the 
security engine microprocessor can read or write data from the scratch memory. 

The security engine Is logically connected to the computer system^s main Bus 108 which is constituted by the data, 
address and control lines. In the preferred embodiment of this Invention, the main Bus is a PCI Bus although one skilled 
in the art can readily sec that any other Bus that performs the same functions can be substituted without materially 
modifying the spirit and scope of this invention. 
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As was previously nolccl the smart card inlerfacc circuit provides lines PAO. PBO, PB 1 , PB2, PB3, Clock, VCC, 
Ground and Reset which receive signals from an attached smart card reader 133v With communication lengtiis olM, 6, 
and 8 bits available, the interface for dilTerent types oFsmart cards and other authentication and identification devices is 
provided. 

Other identification and authentication devices arc provided for in this invention througii an SPI interface that is 
connected to the security engine microprocessor. This allows for the addition of devices such as a biometric reader to 
provide a higher level of security to the system. 

An interrupt line leads from the security engine microprocessor to various circuits vvliich control the interrupt for the 
computer CPU, reset on-oiT, detecting the presence of a smart card in the reader, and timer. Other interrupts can be 
added to these in the futurCv 

The flash memory of the security engine's microprocessor contains six encryption algorithms. One algorithm Is used for 
the generation of the iiash number from the personalized information entered by the holder of a smart card during the 
initial security set up. This hash number is used in the identification and authentication ofthe user of this invention. The 
preferred algorithm is HA VAL although one skilled in tJie art can easily see lhal a similar algorithm may be substituted 
without materially changing the invention. This algorithm is used to generate 3 hash numbers (H 1 , H2, H3) which are 
generated from the personal information inputted by the user during the set up ofthe user security system. These hash 
numbers are stored in the flash memory ofthe security engine microprocessor 125. 

A second algorithm is used for the performance of a second level ofencryplion to the hash numbers generated by the 
tlrst algorithm to generate H ] \ H2' and H3\ The preferred algorithm is a linear congruency function such as XOR 
although one skilled in the art can easily see that an algorithm with similar characteristics may be substituted without 
mtiteviaUy changi/ig the invenUon. 

The third algorithm stored in the flash memor>^of the security engine microprocessor is used to generate a cryptographic 
key (CK) from H2' and for secure communications between the security engine and the smart card. This algorithm is the 
same as tJie one used by ihe smart card for a/I cotnmunicatfons wilh the security engine. The preferred algorithm is 
IDEA although one skilled In the art can easily see that a similar algorithm may be substituted without materially 
changing the invention. 

7'he fourth algonlhfu is Lised for the encryption ofdata in ad peripheral storage devices and which passes through 
conimunication devices such as a modem. The prefLM-red algorithm is an elliptic curve aitiiough one skilled in the art can 
easily see that an algorithm with similar characteristics may be substituted without materially changiuL^ the invention. 

The fifth encryption algorithm is a public key aigoriihm used to encrypt selected data which is to be passed to or Lised by 
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another computer or computers which contain tiiis invention* The preferred algorithm is RSA althougli one skilled in the 
art can easily see that an algorithm with similar characlenslics may be substituted witiiout materially changing the 
invention. 

In order to check for errors in the communications between the smart card and the security engine, the security engine 
EPROM contains a sixth algorithm which is used to create a CRC matrix. In this embodiment oPthe invention, the 
preferred algorithm for the CRC is the Hamming algorithm, although one skilled in the art can readily see that other 
algorithms which perform a similar function may be substituted without materially modifying the scope or spirit of this 
invention. 

For all algorithms used in this invention the key length will be limited to a certain maximum size. This allows for 
conformance to the laws concerning cjicryption key length established by various countries. The key lengths for the 
encryption algorithms which are to be available to the user, as determined by the encryption laws of the country hi which 
this invention is used, are set before configuration of the user security system and before it is delivered to the country in 
which it will be used. The availability of a particular key length is determined by an encrypted key length parameter 
contained within a vendor smart card which is used to check and prepare the computer system for the set up of the 
security system. This key length is stored in the vendor smart card during the initial programming of its on board 
memory. 

The Flash memory of the security engine microprocessor contains a Real Tinie Operating System (RTOS). A kernel 
w^ithin the RTOS schedules the management of all tasks that all peripherals perform. As every computer has a different 
connguralion of peripherals, this kernel creates different priorities according to the particular configuration of a specific 
computer. Jn order to facilitate this, every peripheral in a particular computer Is assigned an adjustable address in the 
scratch memory of the security engine. All tasks involving a peripheral device pass through this address space and it is 
here that all encryption and decryption operations take place controlled by tiie security engine. The order of priority of 
all peripherals is determined by the computer operating system of the computer in which this invention is implemented. 

The programs for all identification and authentication procedures are also stored within the flash memory. This includes 
storage of the security configuration for the motherboard and smart card(s). In addition, the flash memory contains the 
software which enables and disables the I^CI and ISA slots, keyboard address, parallel port and serial port and facilitates 
the interface with any Operating System through the BIOS for security related fimctions. 

Written into the Hash memory of the security engine microprocessor during its manuiaclure is also a secret identiHcation 
number used in the identiilcation of computeis containing this invention over a network* "flijs number is the same for all 
motherboards which contain the present invention. 

An encr\pted tabic of smart caid code nunibers ai'c also Stored in the Hash memory of the security engine, 'fhls table is 
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used during the operation oflhe invention to identiiy the purpose and type ofsniart card inserted in the smart card reader 
wiiicii is logically connected to the security engine. 

Enable/Disable Circuits 

Contained on the motherboard are a series ofcircuits which arc logically connected to the security engine 
microprocessor 125 {lirotrgh data and address lines to a programmabfc device 141 which enables the security engine 
microprocessor to enable or disable (unhide or hide) peripheral devices during the start up oFthe computer. The 
preferred programmable device for this invention is a PLD (programmable logic device) although one skilled in the art 
would recognize that other components which perform the same function may be substituted without materially 
modifying the scope or spirit oFthis invention, This invention comprises the following enable/disable circuits: 

Keyboard Enable/Disable Circuit: Fig. 4 shows a simplified schematic of the enable/disable circuit for the keyboard. 
This circuit comprises a data switch IC 155 with a keyboard data 157 and keyboard clock line 159 logically connected 
to the keyboard connector, two lines, keyboard data 161 and keyboard clock 163 logically connected to the ISA Bus 
1 15, and a keyboard control lljie 165 logically connected to the programmable device which is connected to the security 
engine microprocessor. The preferred data switch IC For this invention is a high speed CMOS 8 bit Bus switch although 
one skilled in the art would recognize that other components which perform the same function may be substituted 
without materially modifying the scope or spirit of this invention. The keyboard control line is used to disable oi' enable 
the keyboard. Connected to the keyboard control line 165 between the data switch IC 155 and the programmable device 
141 is a pull up resistor 162. When the keyboard control line 165 is set to Migh by the security engine microprocessor 
125 via the programmable device 141, the clock 163 and data 161 lines are disabled and any device connected to the 
keyboard connector is effectively 'hidden' from the motherboard microprocessor 101. When the keyboard control line is 
set to Low, the pull up resistor 162 drops the line voltage to 0 V and the clock and data lines are enabled allowing the 
motherboard microprocessor 101 to recognize a device connected to the keyboard connector. 

COM (Communications) Port Enable/Disable Circuit: Fig. 5 shows a simplilled schematic of this circuit. This circuit 
comprises a data switch JC 167 with three lines, TX I (transmit) 169, RX 1 (receive) 171 and RINGl 173 logically 
connected to one COM (Serial) port, another three TX2 (transmit) 175, RX2 (receive) 177 and RING2 179 lines 
logically connected to a second COM port if present, six lines TX I 181, RXl 183, RINGl 185, TX2 187, RX2 189, and 
RING2 191 logically connected to the ISA Bus 1 15, and two COM Port control lines 193 & 195 logically connected to 
the progi'nmmnble device 141 which is connected to the security engine microprocessor. The preferred data switch IC 
for this invention is a high speed CMOS 8 bit Bus switch although one skilled in the art would recognize that other 
components which perform the same function may be substituted without materially modifying the scope or spirit of this 
invention. One of the COM Fori coiilrol lines, COM 1 CONTROL 193, is used to disable or enable COM Port L 
COM2_CON'f ROI. 195 is used to disable or enable COM Fori 2. Connected to the COM l_CONTROL line 193 and 
CQM2__CON"f ROL line 195 between the data switch IC 167 and the programmable device 141 is a pull up resistor 194 

10 


wo 02/33522 


PCT/IBOO/01659 


& 196 on each line. When COMl^CONTROL or C0M2_C0N1"R0L is set to High by Ihc securily engine 
microprocessor via the prograninvablc device, the TX, RX, and RIMG lines are disabled and any device connected to the 
COM port is encctivcly Miidden' from the motherboard microprocessor. When COM l__CONTROL or 
C0M2_C0NTR0L is set to Low, the pull up resistor drops the line voltage to 0 V and the TX, RX, and RING lines arc 
enabled allowing the motherboard microprocessor to recognize a device connected (o (he COM porL Tiirough this 
circuit, up to two COM ports are independently enabled or disabled. 

Parallel Port' Enable/Disable Circuit: As shown in Fig. 6, this circuit comprises two identical data switch ICs 197 & 199 
with eight lines of one olHhe data switches, STROBE 201, FEED 203, DATAO 205, DATA! 207, DATA2 209, 
ERROR 21 1, IMT 213 and SELIN 215 logically connected to the ISA Bus 115, and eight corresponding lines logically 
connected to a parallel port connector. On the second data switch, eight lines, DATA3 217, DATA4 219, DATA5 221, 
DATA6 223, DATA7 225, ACK 227, BUSY 229, and PAPER 231are logically connecled to the ISA Bus 115, and eight 
corresponding lines, logically connected to the parallel port connector. A control line, LPT 1_CTRL 233, logically 
connects one of the data switch ICs to the programmable device 141 which is connected to the security engine 
microprocessor. This control line is logically connected to both data switch ICs. The preferred data switch IC for this 
invention is a high speed CMOS, 8 bit low resistance. Bus switch although one skilled in the art would recognize that 
other components that perform the same Rinction may be substituted without materially modifying the scope or spirit of 
this invention. The h'ne LPTI_CTRL 233 is used to disable or enable the parallel port. Connected to the control line 
between the data switch ICs 197 & 199 and the programmable device 141 is a pull up resistor. When this control line is 
set to High by the security engine microprocessor the two sets of eight lines for both data switch ICs are disabled and 
any device connected to the parallel port is effectively 'hidden' from the motherboard microprocessor. When the control 
line is set to Low. the pull up resistor drops the line voltage to 0 V and the lines are enabled allowing the motherboard 
microprocessor to recognize a device connected to the parallel port. 

Floppy Drive Enable/Disable Circuit: Fig. 7 shows the tloppy drive enable/disable circuit. This circuit comprises a data 
switch IC 235 with two lines, MOTORA (motor) 237 and DRVSA (floppy drive head) 239 logically connected to one 
Hoppy drive connector, two corresponding lines 241 & 243 connected to the ISA to PCI bridge 1 13, another two lines, 
MOTORB 245 and DRVSB 247 logically connected to a second floppy drive connector if present, two corresponding 
lines 249 & 251 connected to the ISA to PCI bridge 1 13. and two tloppy drive control lines, CTRL_FLOPPYA 253 and 
CTRLJ-LOPPYB 255, logically connected to the programmable device 141 which is connected to the security engine 
microprocessor through a programmable device. 1"he preferred data switch IC for this invention is a high speed CMOS 8 
bit Bus switch although one skilled in the art would recognize that other components which perform the same function 
may be substituted without materially modifying the scope or spirit ofthis invention. One of two floppy drive control 
lines. CTRLJ-LOPPYA 253, is used to disable or enable one floppy drive. CTRLJ-LOPPYB 255 is used to disable or 
enable a second floppy drive if present. Connected to the CTRL_FLOPPYA line 253 between the data switch IC 235 
and (he programmable device 141 is a pull up resistor and a second pull up resistor is also connected lo the 
C'fRLJ-LOPPYB line 255 between the data switch IC 235 and the programmable device 141. When CTRL FLOPPYA 
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253 or CTRLJ-LOPPYB 255 is set lo High by the security cni^inc microprocessor via llie programmable device 141, 
Ihe MOTOR and DRVS lines arc disabled and any device connected to tlie lloppy drive connector k encctivcly Miidden' 
froni the motherboard microprocessor. When CTRLJ^LOPPYA or CTRL_FLOPPYB is set to Low, the pull up resistor 
drops the line voltage to 0 V and the MOTOR and DRVS lines are enabled, allowing the motherboard microprocessor to 
recognize n device connected to the Hoppy drive connector. Through this circuit, up to two Hoppy drive connectors are 
independently enabled or disabled. 

ISA Slot Enable/Disable Circuit: Thh circuit, as shown in Fig. 8, can independently enable/disable up to three ISA slots. 
The circuit for enabling/disabling a single ISA slot is comprised oFa single data switch IC 257 with six lines: 
SMEMWR (system memory write) 259, SMEMRD (system memory read) 261, lOW (I/O write) 263, lOR (1/0 read) 
265, MEMRD (memory read) 267 and MEMWR (memory write) 269 logically connected to the PCI to ISA Bridge 1 13, 
and six corresponding lines logically connected to an ISA slot. A control line, ISA_CTRb 271, logically connects the 
data switch IC 257 to the programmable device 141 which is connected to the security engine microprocessor 125. The 
preferred data switch IC for this invention is a high speed CMOS, 8 bit. Bus switch although one skilled in the art would 
recognize that other components which perform the same runclion may be substituted without materially modifying the 
scope or spirit of this invention. The line ISA_CTRL 271 is used to disable or enable the ISA slot 108. Connected to the 
control line 271 between the data switch IC 257 and the programmable device 141 is a pull up resistor 272, When this 
control line 271 is set to High by the security engine microprocessor 125 the two sets of six lines for the data switch IC 
257 are disabled and any device connected to the ISA slot 108 is effectively ^hidden' from the motherboard 
microprocessor lOL When the control line 271 is set to Low, the pull up resistor 272 drops the line voltage to 0 V and 
the lines are enabled allowing the motherboard microprocessor 101 to recognize a device connected to the ISA slot 108. 

PCI Slot Enable/Disable Circuit: The simplified schematic for the PCI slot enable/disable circuit is shown in Fig. 9. This 
circuit can enable/disable up to four PCI slots. The circuit for enabling/disabling a single PCI slot is comprised of two 
data switch ICs 273 & 275 with two GNT (grant) lines 277 & 279 and two FRAME (cycle frame) lines 281 & 283 
logically connecting the first data switch IC 273 to the PCI Master 103. From the second data switch IC 275 in the 
enable/disable circuit TRDY (target ready) 285, DEVSEL (device select) 287 and REQ (request) 289 lines are logically 
connecled lo the PCI Master 103 and three corresponding lines are connected to a PCI slot. A control line, PC1_CTRL 
29K logically connects both data switch ICs 273 & 275 to the programmable device 141 which is connected to the 
security engine microprocessor 125. "fhis control line is logically connected to both of the data switch ICs. The preferred 
data switch IC for this invention is a high speed CMOS, 8 bit. Bus switch although one skilled in tiic art w^ould recognize 
that other components which perform the same function may be stibstituted without materially modifying the scope or 
spirit oi'this invention. The line PCLCTRL 291 is used to disable or enable the PCI slot. Connected to the control line 
between the data switch IC and the programmable device is a pull up resistor. When this control line is set to High by 
thesecunly engine microprocessor, the two GNT 277 & 279 and two FRAME lines 281 & 283, TRDY 285, DEVSEL 
287 and REQ 289 lines are disabled and any device connected to the PCI slot is effectively 'hidden' from the 
motherboard microprocessor. When the control line is set to Low, tlie pull up resistor drops the line voltage to 0 V and 
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the lines arc enabled allowing the motherboard microprocessor to recognize a device connected to the PCI slotv 

IDE Enable/Disable Circuit: Figs. lOA & I OB show the IDE enable/disable circuit. This circuit can enable/disable up to 
two IDE slots, cither in the Primary IDE 111 or in the Secondary IDE 112. The circuit for enabling/disabling the 
Primary IDE is comprised oftwo decoder/multiplexer ICs 293 & 295, one data switch IC 297, a I-LIP FLOP IC 299, 
two Positive 'AND' gates 301 & 303, and two Positive 'OR' gates 305 & 307. A matching circuit is used to 

enable/disable the Secondary IDE. The following description oFthe enable/disable circuit is for the Primary IDE but an 
identical circuit is required to enable/disable the Secondary IDE. One entire circuit is required for the Primary IDE and 
one for the secondary IDE. 

The preferred decoder/multiplexer IC for this invention is a three line to eight line decoder/multiplexer although one 
skilled in the art would recognize that other components which perform the same function may be substituted without 
materially modifying the scope or spirit ofthis invention. The preferred data switch IC for this invention is a high speed 
CMOS, 8 bit; Bus switch although one skilled in the art w^ould recognize that other components which perform the same 
function may be substituted without materially modifying the scope or spirit ofthis invention. The preferred FLIP FLOP 
IC for this invention is a dual D-type positive edge triggered FLIP FLOP with preset and clear although one skilled in 
the art would recognize that other components which perform the same function jnay be substituted without materially 
modifying the scope or spirit of this invention. The preferred 'AND' gate for this invention is a triple three input positive 
'AND' gate although one skilled in the art would recognize that other coinponents which perform the same function may 
be substituted without materially modifying the scope or spirit ofthis invention^ . The preferred 'OR' gate for this 
invention is a quadruple two input positive 'OR' gate although one skilled in the art would recognize that other 
components which perform the same function may be substituted without materially modifying the scope or spirit ofthis 
invention. 

From the first decoder/multiplexer IC 293, three PDA (primary address) lines 308, 309 & 310 and one PIOW (Primary 
I/O pin write) line 31 1 are logically connected to the PCI to ISA Bridge 137_ This first decoder/multiplexer IC 293 is 
then logically connected to the FLIP FLOP 299 and both of the 'AND' gates 301 & 303. The FLIP FLOP 299 is 
connected to both the 'OR' gales 305 & 307, One of these 'OR' gates 305 is logically connected to one of the 'AND' 
gates 301 which in turn is connected through a Master line 313 to the data switch IC 297. The other 'OR' gale 307 is 
logically connected to the second 'AND" gate 303 which in turn is connected through a Slave line 315 to the data switch 
IC 297. Logically connecling the data switch IC 297 to the PCI to ISA Bridge 137 arc four lines; PIOW (Pri/TiarV I/O 
Write) 317, PIOR (Primary I/O read) 319, and two PCS (Primary host chip select) lines 321 & 323. Four corresponding 
tines logically coimect the data switch IC 297 with an IDE connector. 

Prom the second decoder/multiplexer IC 295, a PIOR (Primary I/O pin read) 325 and PCS (Primary host chip select) 
line 327 arc connected to the PC! lo ISA Bridge 137. 11ns second decodcr/nuiliiplexer !C \$ logically connccled to the 
two ^AND' gates 301 303 wiiich are logfcalls^ connected to the data sw^itch IC 297, one through ti Master line and the 
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other (hrougli a Slave fine, 

A conlrol line, PIDEMST__CTRU (Primary IDB Master control) 329, logically connects the programmable device 141, 
which is connected to the security engine microprocessor, and the 'OR' gate 305 which is connected to the Master 
'AND' gate 301. The line PIDEMS7^_CTRL 329 is used to disable or enable the Primary Master IDE slot 1 1 K 
Connected to the control line between the 'OR' gate 305 which is connected to the Master 'AND' gate 301 and the 
programmable device 141 is a pull up resiston When this control line is set to High by the security engine 
microprocessor 125. the PIQW (Primary I/O Write) 317, PIOR (Primary I/O read) 319, and two PCS (Primary host chip 
select) 321 & 323 lines are disabled and any device connected to the Primary Master IDE slot is effectively 'hidden' 
From the motherboard microprocessor^ When the control line is set to Low, the pull up resistor drops the line voltage to 
0 V and the lines are enabled allowing the motherboard microprocessor to recognize a device connected to the Primary 
Master IDE slot 

A second control line, PIDE$LV__CTRL (IDE Slave conlrol) 331, logically connects the programmable device 141, 
which is connected to the security engine microprocessor 125, and the 'OR' gate 307 which is connected to the Slave 
'AND' gale 303. The line PIDESLV_CTRL 329 is used to disable or enable the Primary Slave IDE slot 1 1 1. Connected 
to the control line between the 'OR' gate 307 which is connected to the Slave 'AND' gate 303, and the programmable 
device, is a pull up resiston When this conlrol line is set to High by the security engine microprocessor, the PIOW 
(Primary I/O write) 317, PIOR (Primary I/O read) 319, and two PCS (Primary host chip select) 321 & 323 lines are 
disabled and any device connected to the Primary Slave IDE slot is effectively 'hidden^ from the motherboard 
microprocessor. When the control line is set to Low, the pull up resistor drops the line voltage to 0 V and the lines arc 
enabled allow^ing the motherboard microprocessor to recognize a device connected to the Primary Slave IDE slot. 

Modified BIOS 

Comiected to the computer's main BUS 108 via a bridge circuit 137 and the ISA BUS 1 15 is a ROM device 109 that 
contains the Basic Input/Output System (BIOS) software. The BIOS controls the computer's most basic, low level 
control functions and supervises its operations> In the present invention, the standard BIOS is replaced with a modified 
BIOS through the replacement ol'the ROM device containing the standard BIOS on the motlierboard. The modified 
BIOS software allows the said security engine microprocessor to take over control of the computer from the 
motherboard CPU lOK 'fhis is supported through a modification to the design of a standard motherboard in wiiich the 
address, data, and control lines whicli carry the signals of the main BUS are physically rerouted to be logically 
conneclcd io (he microprocessor of the security englne> The modified BIOS also sets Up nil security procedures upon 
computer start up and secures data during the computer's operation and hides all data storage devices and other user 
selected peripheral data storage and communication devices upon start up and sluit down of the computer. The 
modincatioiis of the present invcnliun^s BIOS uiclude sofiware routines thai support: 

• Access Control Management: The user can conllgure a single computer system to allow different levels of access. 
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• ConlroIIing the loadiJig of" device drivers lor all peripheral storage and communication devices and creating a 
system mnnagcr before the O.S. tal<es over llie system, 

• Disabling orall non-niilhorized peripherals according the security procedures established on the security conHgured 
security engine, 

• Setting up the security conflguraHon oflhc computer. Tlie settings for the security configuration include: which 
peripiieral devices are to be enabled or disabled For a specific user and which device di'ivers will have encryption or 
decryption capabilities* For example, this latter setting allows the user the ability to select wiiich data storage 
devices such as an IDE or SCSI hard drive are to be encryptedv 

• Providing a Way to securely communicate with and authenticate the identity of other computers that are using the 
same technology as this invention. 

Smart Card 

A smart card reader 133 is logically connected to the smart card reader interface 135 which in turn is connected to the 
programming circuit 129 and the microprocessor 125 of the security engine> In the preferred embodiment of tlie 
invention, encrypted integrated circuit cards (smart cards') are used for the identification and verification of authorized 
users and which control the level of access to a computer system by its containing cryptographic keys which are required 
before any particular peripheral device will be enabled. By limiting the number of keys present in a smart card, access to 
specific peripherals can be restricted on a device by device basis. The smart card is read through a smart card reader 
connected to the security engine. The smart card suitable for this invention typically contains a microprocessor and more 
than one internal memory. In the preferred embodiment this plurality of internal memory comprises internal RAM, on- 
board ROM and EEPROM. The preferred card is one which is compatible with ISO 7816 standards although one skilled 
in the art would readily recognize that other smart cards may be substituted without materially modifying the scope or 
spirit of this invention. 

Contained within the first internal memory or ROM of the smart card is software w^hich may be considered a small 
operating system with a BUS that supports data flows between one and five bits in length depending on which type of 
smart card is used. 

Also stored within the ROM arc the same six encryption algorithms as are found in the flash memory of the security 
engine. The first is a public key leased cryptographic algorithm that provides encryption and decryption for 48 and 6<4 
bits of data. This, and the same encryption algorithm stored in the security engine ensures that the initial data Howing 
between tfic smart cai'd reader and the seeui ity engine microprocessor during the synchrom'zation of comnumications is 
Secure if inierceptcd. In the preferred embodiment, the algorithm used in the smart card ibr this task is RSA although 
one skilled in the art would readily recognize that other algorithnis that are compatible with RSA may be substituted 
without materially modifying the scope or spirit of this invention. The same algorithm can be used for 6 and 8 bits of 
data. 
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The second nl^joritliiii stored in Ihe ROM of the smart cnrd, is an algoritlim used to generate hasli numl)crs from llic 
personal inforniatlon entered by the user In tiie Identification area of the smart card's ROM memory map. The prclcrrcd 
algorithm fs HAVAL although one skilled in Ihc art can easily sec that a similar algorHhm may be substitiited without 
materially changing the Invcntion. 

The smart card ROM also contains tiie same linear congruency function, algorithm For generating ihe CK, algorithm For 
encrypting all data which is stored in peripheral storage devices or passes through communication devices, and 
algorithm for creating a CRC matrix, as is stored in tiie internal memory of the security engine microprocesson 

The second internal memory or EEPROM memory oFthc smart card is used for user authentication and is divided into 
three major parts - Identification, Key Management, and Application. 

Contained within the Idenlincallon area is space For personal identification information Inputted by the computer user. 
This includes such things as the user's name, address, telephone number etc. In this area, there is also space for 
identification numbers and account numbers to be inputted by outside or external agencies such as the government, 
financial institutions, health care agencies etc. The Identification area also contains a register of codes which are used to 
ideiitify the type of smart card. 

The Application area is divided into two sections, an index and a data storage section. The index operates similar to a 
small File Allocation Table (FAT) which records the location and the amount of space occupied by each application. 
The index is also responsible for allocating extra space to an application iPrequired. Each application in this area is 
uniquely identiiled by a two byte code which identities the communication key tor each application. The use oFthis two 
byte code supports the inclusion of up to 65.536 different applications. 

Space Is allocated in the Application area for the storage of general Information Inputted by the user or authorized 
outside agencieSv f^ead and wM*ile access to this area can only be done by another computer w^hicii utilizes (lie present 
invention and possesses a cryptographic communication key w^hich matches the one stored in the smart card to which 
access is desired. Access to a specific application also requires the tw^o byte code In order to locate the data. The data 
storage section can contain application data or software wiiich can also be loaded into the Internal RAM or EEPROM of 
the smart card and run. 

Within Ihe EEPROM of tl)e smart card is n lookup table wiiicJi contains ail Ihe commands which are required for ihis 
invention, if in the future, more commands are required the size of the table in the EEPROM can be increased and more 
commands added. 

All communic^l^ion keys necessary for encrypted communication, such as communications between the smart card and 
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the security engine microprocessor, are also placed in Ihc Key Managenienl area of the smart card iSBPROM. 

In this invention, three dilTcrent lengths of communication arc supported between the security engine microprocessor 
and the smart card reader. They arc 1 l^ytc, 6 bytes and 8 bytes* This allows the invention to be compatible with several 
dilTcrenl types oFsmart cards and to also support other identiHcation and authentication devices sucli as button mcinory 
and biometric readerSv Status commands involving communication set-up, synchronization, and prompts are encrypted 
and are eight bits ui length. Ail commands are 48 bits long and data Hows are 64 bits long and arc also encrypted. Due to 
the amount of information which must move between the security engine and the smart card, the speed required, and the 
Jiecessliy to support different lengths of coJiimunication protocols, this invention involves a check for errors using a 
CRC (Cyclic I^edundancy Ciieck) algoritlim. In this Invention the algorithm used is tlie Mamming Code although one 
skilled in the art Would readily recognize that other algorithms which are compatible with tiie Hamming Code may be 
substituted witiiout materially affecting this invention. 

This area also contains hash numbers that arc created from the personal information stored in the Identification area and 
are unique to each computer system implementing this invention. Also stored in the Key Management area of the smart 
card ROM are unique, encrypted identification codes tliat arc used to create different types or classes of smart cards witii 
diOerent capabilities^ 

There are three major classes of smart cards: vendor, repair, and user. 

One class of identitTcation codes is reserved exclusively for 'vendor' cards. The vendor cards are used only by sellers of 
computer systems containing tiie invention. The EEPROM of the vendor card is divided into only two areas, a Key 
Management area aiid an IdentiHcation area » The Key Manageiiient area contains secuiity pai-ametei's such as the 
allowed key length for encryption algorithms inputted during the card's manufacture, and the previously noted public 
key based cryptographic algorithm for initial communications between the security engine and the smart cardv The 
Identification area contains a unique vendor identification number and the common register of identification codes. 
These cards allow limited access to set up and check a computer before the security procedure is set up and. when used 
in conjunction with a repair card, allows limited access to repair or service the computer after the security procedure has 
been implemented. 

The 'repair' class of smart cards can be used only with a matching computer containing the present invention and 
provide limited access to the computer in order to diagnose and repair it, 1'he code tor a repair card is placed in the 
Smart card register during hs manufacture and this code can never be changed. This class of smart cards contains the 1-12" 
hasli number that is the complement ol^he 1 12 hash number which is stored In the securitN^ engine memory, and the same 
kc\ for communication. 11ie repair type smart card contains only two areas in its menK>r\' - the Ke>^ Management area 
and a Restricted tu-ea. The Key Management area contains only the hash numbers and tlie communication key. 'flic 
ReKlricted area contains an index ofdatn Hies or diircioricK that are hidden and thcrelbr cannot be accessed, "fhis allows 
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the computer to be fully funclional for repairs while still maintaining the conlldenliality ofdata stored in it. In addition, 
the repair card will have no nl:>ilily to make any changes to the Idcnlillcation or Application areas as they are not present 
in the card. 

The other major class oT identiilcalion codes is for 'user' cards. User smart cards arc further identiHcd by code as 'new' 
or 'used\ 'New' user smart cards are those which have not previously had identification information inputted into the 
Identification area ofthe smart card and subsequently do not also contain hash numbers. 

In order to support hierarchies of smart cards and corresponding computers, user smart cards can also be coded as 
'Standalone Master^ cards (SAM), 'Master/Slave' cards (MS) or 'Slave' cards. The designation of a new user card as a 
SAM, MS or Slave type is decided during its initial set-up by the usen The identrfication code For a user smart card is 
then placed in the register opcodes in the smart card memory. The computer system in Which a particular type of user 
card is created also carries the same designation as the smart card. Thus, the creation of a SAM card creates a SAM 
computer. The particular card and computer can be referred to as a SAM system. 

A SAM card is typically used by a system administrator and is used to set up MS cards or Slave type cards. As its name 
suggests, it is also used for individual computer systems which have no related computer systems in its network or 
family. The presence oFa code identifying a smart card as a Standalone Master card gives it access to a routine which 
allows the set up of any number of Master/Slave or Slave systems. In addition, Master/Slave systems have the capability 
to set up both subordinate MS systems and Slave systems, while Slave cards cannot generate any other smart cards. In 
this manner, a hierarchy of related computers can be created^ In a family of related computers, there can be only one 
SAM card and subsequently only one SAM computer. Also, no matter the number of computers in a family, there must 
be one SAM card and its corresponding computer. 

Although MS cards have the ability to create subordinate MS or Slave systems, this function may be disabled during the 
creation of an MS system. If a user chooses to disable the MS card's ability to create subordinate systems, the card is 
identified by an identity code for disabled MS cards in tiie Key Management area ofthe smart card ROM, 

In the Key Management area ofthe smart card ROM of a SAM card, one set of three hash numbers H 1\ M2\ and 1-13' 
are stored. These three hash numbers are generated through a two step process. The Ilrst step involves the use of an 
algorithm on the personal identillcation information which is placed in the memory ofthe security engine 
microprocessor during the initial set-up by the user. This creates three hash numbers H 1 , 1-12, and I-I3. Hie preferred 
aluorithm for this is HAVAL although one skilled in the art can easily see that a similar algorithm may be substituted 
without materially changing the invention. The second step involves applying a linear congruency algorithm such as 
XQR to these three hash numbers in order to generate H \ \ M2' and H3\ In addition, a single key (CIv) required for 
communications, also stored in the Key Management area, is created and used by a SAM card. 1'his communication key 
is venerated from 1 12' thnnmh the use of an aliioriihm. The preferred aluorithm used to produce this communication key 
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is IDEA alihough one skilled in the art can easily see that a similar algorillini may be subsliUited without materially 
changing the spirit or scope ofthis invention. The SAM card is able lo write in the set-up area ofan M£S or Slave smart 
card of another computer which utilizes the present invention but which has not been previously set up. However, a 
subordinate MS or Slave computer Is no! empowered io access and change its secuniy conflguralion or idcnlillcation 
information. Thus, a subordinate MS or Slave computer that has been set up by a SAM card can only iiave its security 
configuration or identification information modiHed by that SAM card and no other. However, the subordinate computer 
can be operated tiirough the use of. either the smart card which was set up With it, or the SAM card which was used to 
create tiie subordinate system, hi order to operate a subordinate computer that it created, the SAM card has stored in its 
interanl memory the hash numbers stored in the meinory of the security engine of the subordinate computer. 

hi the Key Management area ofan MS card, two hash numbers (HI ' and H3'), which were created from the personal 
identification information inputted to the Identification area of the smart card, are stored. A third hash number, H2\ is 
derived from the H2 stored in the SAM or MS card which is used to create tlie subordinate MS card, and also placed in 
the Key Management area of the MS card, hi this way, using the fact that the H2 and H2' hash numbers are 
complementary, access to a subordinate MS computer only by the SAM or MS card which created it, or its own MS 
smart card, is established. Mo changes can be made to the MS card without the use of the SAM or MS creator card. In 
order to facilitate access by the card which created it, the subordinate MS card contains in its Key Management area the 
CK of the creator card* The MS card also has its own unique communication key derived from the H2' hash number 
through the use ofan algorithniv The preferred algorithm used to produce this communication key is IDEA although one 
skilled in the art can easily see that a similar algorithm may be substituted without materialiy changing the spirit or scope 
ofthis invention. 

As was previously noted, the MS card is able to create subordinate MS systems that can be operated through the use of 
the MS card which was produced in the creation of the system or the use of the MS card that was used to create the 
subordinate system. However, changes to the personal identification area or the security set-up require the presence of 
the MS card that was used in the creation of the system. During the creation ofan MS card, the ability of the new card to 
further create new MS or S!ave cards and systems itself can be disabled. This is done through a selection made in the 
security configuration set up of the new MS card. This decision is then stored as a code number in the Key Management 
area of the smart card internal memory. 

In the creation of a subordinate MS system, the hash number H2' is taken from the MS card which is used lo create the 
subordinate system. Using a pseudo-random number generator this hash number is then changed to create a new H2\ 
TJie preferred algorithm for this is a linear congruencv Function such as XOR although one skilled In the art can easily 
see that an algorithm with similar characteristics may be substituted without materially changing the invention. This new 
H2' number is placed in the K^y ManagemeiK area ol'the new MS card along whh iwo hash numbers (Ml' and i-i3') 
which were created h-om tlie personal identitlcation information inputted in to the Identification area of the new MS 
smart card, "fhe creator MS card is allowed access to the hash numbers stored in the memoiy of the security engine of 
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the subordinate MS computer which it created. In tills way, access to an MS computer only by the MS card whicii 
created lU or lis own MS smart card, is established. Mowever, no changes can be made to tiie subordinate MS system 
without the use ofthe MS card that created il. As mentioned, the subordinate MS system has a unique communication 
key derived from its M2' hash number in addition to the CK ofthe card which created it. 

The Key ManagcmenI: area of a Slave card contains the hash numbers (H I \ H2\ and and communication key (CK) 
of' the SAM or MS card which created ]t The Slave card also has a unique CK, generated from the H2' hash number 
given to it by its creator card. A Slave computer can therefor be accessed by its own Slave card and the MS or SAM 
card that was used to create it The SAM or MS card which w^as used to set up the Slave card has full access to the use of 
the Slave computer and can be used to change the security configuration of that compLitcr> Despite possessing the same 
hash numbers of the smart card that created it, due its identification code identifying it as a Slave card, the Slave card 
cannot be used in any other computer other than the one itw^as set up for In addition, in order to prevent the Slave 
computer from being mistaken for the coinputer which created it, especially during communications with other 
computers, the Application area ofthe Slave smart card is disabled. In addition, the encryption and decryption function 
is disabled for all data which passes outside ofthe Slave computer The Slave card does not have the ability to make any 
changes to the Idenlincation area as this can only be done through the use ofthe MS or SAM smart card which 
originally set it up. 

Device Driver Layer 

Modifications are made to the Device Driver Layer that replaces the standard Device Driver Layer in the computer's 
Operating System that typically resides in the hard drive of a computer. The ability to stop the loading of peripheral 
devices during the start up or interrupt procedure of a computer is supported by modifications made to the device driver 
layer. This modiilcation Involves changes made to the device driver software in which the device drivers are not able to 
initialize and set up if a particular encrypted piece of code for it is not present in the flash mejnory ofthe security engine 
microprocessor. 

The modified DDL also supports the ability ofthe computer employing this invention to Miide" restricted files or folders 
during repair or maintenance procedures using a repair card. This modification requires thai, upon the insertion of a 
repair card into the smart card reader of a system employing the present invention, the device driver w>hich receives a 
read or write procedure call to read an encrypted list of restricted items which had previously been stored in RAM on the 
motherboard* If the read or write aclivity involves a Hie or folder which is on the restricted list, it is disallowed. 

Modifications to the DDL and the inclusion of an 1/0 address map and circular memor\^ buffer circuits also permit this 
invention to encrypt or decrypt selected data moving to and from peripheral devices^ 'fhrough these circuits, data to be 
encrypted or decrypted is inierceptcd. temporarily stored in the circular nicmorv bufler, encrypted or decrypted, and 
passed on to the appropriate peripheral device. This also requires providing llie lower level functions necessary for real 
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time encrypt and decrypt procedures under any Operating System, through tlie scratch memory. A modincation to the 
DDL allows each driver to create a header Ibr each task requiring encryption or decryption. This header contains 
information regarding the size of the plaintext to be encrypted, or the size oi' the encrypted code to be decrypted: the 
type of* operation to be perlbrmed — whether involving a storage device, network or modem: and the number of plaintext 
divisions required given the circular memory bulTer capacity. 

The modifications to the DDL involving the provision of lower level functions necessary for real time et^crypt and 
decrypt procedures under any Operating System, through the scratcli memory and the generation of a header, also 
provide a base for the encryption of data, wiiich is to be sent through a periplieral device such as a modem, or tlirough a 
network, that can only be decrypted by a specific target computer employing this invention. They also allow for the 
encryption of data stored on some data storage medium such as a diskette, tape, CD, or hard drive that can only be 
decrypted by the target computer containing this invention^ A key addition to these modifications is the inclusion of a 
parameter from the personal identification CMOS table and a unique motherboard serial number from the target system 
in the header created for the encrypted data. The parameter from the personal identillcation information used in the 
header is selected by the user. 

ISA Circular Buffer 

Another necessary modification is the logical connection of the device driver layer through the ISA Bus to the security 
engine microprocessor. This allows for the real time encryption and decryption of data flowing to all peripheral storage 
and conimunication devices using the cryptographic algorithms contained in the security engine memory. In order to 
achieve this, a circuit is placed between tiie ISA Bus and the security engine microprocessor in order to control and store 
data for encryption and decryption which is performed by the security engine microprocessor. The circuit that allows for 
this is comprised of a programmable IC, four circular memory buffer ICs, and four Bus bufter ICs. Figs. 1 lA and 1 IB 
show a simplified schematic of the ISA Bus Circular Buffer. 

The preferred programmable IC for this invention is a programmable array logic (PAL) device although one skilled in 
the art would recognize that other components that perform the same function can be substituted without materially 
modifying the scope or spirit of this invention. The preferred circular mei7iory bulfcv IC for this invention is a CMOS 
asynchronous circular memory buffer dual port memory bulTer although one skilled in the art would recognize that other 
components that perform the same function may be substituted without materially modifying the scope or spirit of this 
invention. The prefcncd Bus buffer IC for this invention is a quadruple Bus bulTer \vith 3 stale outputs although one 
skilled in the art would recognize that other components which perform the same function may be substituted without 
materially modifying the scope or spirit of this invention. 

The programmable IC 332 is logically connected to the ISA Bus 1 15 through ten address Hues (AddressO to Addrcss9) 
333 and AHl^ (address eirable) 335, lOW (I t) wrhe) 337, lOR (1/0 read) 339, and 1016 (line which indicates that a 16 
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bit address has been asserted) 341 lines. Connected to the 1016 line 341 is a Bus bufTer IC 343. A RD_STATUS (read 
status) line 345 logically connects the PAL IC 332 to the first Bus bulTer IC 344, the third Bus bulTcr IC 347 and the 
fourth Bus bulTer IC 349. On the RD_S1^ATUS line 345 between the PAL 332 and Bus buffers 344, 347 & 349 is a pull 
up resistor 351. When the RD_STATUS 345 line is Set to Low, the pull up resistor 351 drops the line voltage to 0 V and 
the data lines (SDO 353, SDI 355, and SD2 357 connected to the data Bus of the ISA Bus are enabled, allowing tiie 
status of the circular memory bufTer For reading or writing to be sent to the device driver of the peripheral involved. 

Logically connecting the programmable IC 332 and the security engine microprocessor 125 is a 

HEADER_HANDSHAKE line 359 that contains a pull up resistor 361. This line carries a signal to the security engine 
microprocessor 125. When the pull up resistor 361 sets the line Low, this causes the microprocessor 125 to read from 
the circular memory buffer a header that contains the settings for all encryption or decryption tasks. This header contains 
all the parameters for the encryption or decryption such as the size of the data block, the type of operation to be 
performed, and the number of plaintext divisions. The header is created in the device driver layer and placed in the 
circular memory buffer through the ISA Bus by the specific device driver that receives the encpy'ption or decryption read 
or wTite request. 

Tlie first BUS buffer IC 343 in the circular memory buffer circuit is logically connected to the first circular memory 
buffer 363 through a SEC„ENGINE„RD_EMPTY (security engine memoiy empty read) 365 line. This buffer is also 
connected to line Data2 of the ISA Bus through line SD2 357. The third Bus buffer IC 347 is logically connected to the 
third circular memory buffer through a SEC_ENGIME_WR_FULL (security engine memory full write) line 367, This 
buffer is logically connected to the Datal line of the ISA Bus through a SDI line 355. The fourth Bus buffer IC 349 is 
directly connected to the fourth circular memory buffer IC 369 through the SEC_ENG1NE_RD_EMPTY line 397 and to 
the DataO line of the ISA Bus through an SDO line 353. The third 347 and fourth 349 Bus buffers are logically 
connected to each other and through the RD_STATUS line 345> A CSWR (chip select write) line 375 logically connects 
the third 377 and fourth 379 circular memory buffers, 'f he CSWR line 375 is connected to two circular memory buffers 
that arc connected by the same RD_STATUS line 373. These tw^o circular memory buffer act as data memory buffers for 
(he encryption or decryption of all write procedures initiated in the device driver layer, A CSRD (chip select read) line 
381 logically connects the first 363 and second 383 circular memory buITers. Only the first circular memory bulTcr 363 
is connected to the RD_STATUS line 345 from the PAL 332, These two circular memory buffers 363 & 383 act as data 
memory bulTers for the encryption or decryption of all read procedures initiated in the device driver layer. Logically 
connecting all four circular memory bulTer ICs and the ISA Bus is a RESET line 385. Each circular memory buffer is 
also connected lo the ISA Bus through eight SD (ISA data) lines 387, Each circular memory buffer is logically 
connected lo the security engine microprocessor through eight DO (security engine data) lines 389. The first 363 and 
second 383 circular memory bufier ICs, which are connected by the CSRD line 38! from the PAL, arc both connected to 
the security engine microprocessor through a SEC_ENC1NE_WR (security engine write) hue 391. 'fhc tlrst circular 
memory buffer IC 363, has SEC_ENG1NE„RD_EMPTY 365 and SEC ENGINE_RD_FULL 393 lines which arc 
louicallv connected to the .securitv enuine microprocessor. The third 377 and fourth 379 circular mcmor\' bulTvr ICs, 
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which nre connected by the CS\VR line 375 from the PAL 332, arc both connected to the security engine microprocessor 
through n SI:C_i3NGlNlZ_RD (security engine read) line 395. The third circular memory biiHer IC 377 has a 
SIZCJ5NGINB_WRJ3MPTY {security engine memory empty write) Ihie 397 and SECJSNGINE_WRJ- OLb (security 
engine memory lull write) line 367 thai are logically connected to the security engine microprocessor^ 

PCI Circular Buffer 

Another necessary modificalion is the logical connection ofthe device driver layer through the PCI Bus to the security 
engine microprocessor. This allows for the real time encryption and decryption of data flowing through the PCI Bus. As 
with the ISA circular buffer, cryptographic algorithms contained in the security engine memory are used. In order to 
achieve this, a circuit is placed between tiie PCI Bus and the security engine microprocessor in order to control and store 
data for encryption and decryption which is performed by the security engine microprocesson The circuit that allows for 
this is comprised of a Programmable IC, two circular memory buffer ICs, one *NAND' Gate IC, and a PCI Bridge to 
Local Bus Interface IC. This is shown in Fig. 12. 

The preferred Programmable IC for this invention is a programmable logic device (PLD) although one skilled in the art 
would recognize that other components that perform the same Function can be substituted u^ithout materially modifying 
the scope or spirit of this invention. The preferred circular memory buffer IC for this invention is a CMOS synchi'onous 
bi-circular memory buffer with Bus matching although one skilled in the art \Vould recognize that other components that 
perform the same function may be substituted without materially modifying the scope or spirit of this invention. The 
preferred 'NAND' gate for this invention is a quadruple two Input positive 'NAND' gate although one skilled in the art 
would recognize that other components which perform the same Function may be substituted without materially 
modifying the scope or spirit of this invention. The preferred PCI Bridge to Local Bus Interface IC is a V292PBC 
although one skilled in the art would recognize that other components which perform the same function may be 
substituted without materially modifying the scope or spirit of this invention. 

The PCI Bridge to Local Bus Interface IC 137 is logically connected to the PCI Bus 108 through a PCi Bus line 40L A 
PCLK (PCI Clock) line 403 also logically connects the PCI Bridge 108 to the Local Bus Interface IC 137. Connecting 
the PCI Bridge to Local Bus Interface IC 137 to the programmable device 141 is a Local Bus. This Local Bus is 
logically connected to the programmable device through the following lines: 10(3 1 iQ) (Local Instruction and data Bus) 
405, A(3\l2) (Address and data) 407, LREQ (Local Bus request) 409. BURST (Burst request) 41 L RDY (Local Bus 
data ready) 413. LBREQ (Local Bus request) 415. LBGNT (Local Bus grant) 417. R/W (Read/write) 419, LCLIC (Local 
Bus clock) 42L and LINT (Local Bus internipt) 423. Logically connected to the LINT line 423 is tin 'NAND' gate 425. 
This ^NAND^ gate has RLAD IZMPTY 430. WRITIZJ-ULL 431, WRlTEJiMPTY 433, and RRADJ-ULL 435 lines 
logically connected to the programmable device 14L 'fhe 1D(3 1:0) line 405 is logically connected to the programmable 
device 141 and both circular memory bulTers 139ii & 139b. The A(3 1 :2) line 407 is directly connected to the 
progrnmmab le device. 
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A WRITB line 437 is logicaily conneclcd (o the Hist circular memory bufTcr 139a. From this WRITE circular memory' 
buITcr a SEC_ENGINE_WRJ-ULL (Security engine write lull) 439 and a Src_ENGINIS_WR_BMP^rY (Security 
engine write empty) 441 line are logically connected to the security engine microprocessor. The 
SEC_ENGINE_WR_rULL Jinc 439 is also connected to the programmable device 141. Also connecting the security 
engine microprocessor 125 and the llrsl circular memory buffer 139a is a SEC_ENGINE_RD (Security engine read) line 
443 and a SEC_ENGINE_DATA_BUS (Security engine data Bus) line 445. The SECJ5NG1NE_DATA__BUS line 445 
is also logically connected to the second circular memory buffer 139b. 

A READ line 453 is logically connected to the second circular memory buffer 139b. From this READ circular memory 
buffer a SEC__ENGINE__RD_FULL (Security engine read full) 447 and a SEC_ENGiNE_RD_EMPTY (Security engine 
read^empty) 449 line are logically connected to the security engine microprocessor 125. The 

SEC_ENGINE_RD_EMPTY line 449 is also connected to the PCI Buffer programmable device 141. Also connecting 
the security engine microprocessor 125 and the second circular memory buffer 139b is a SEC_ENGINE_WR (Security 
engine write) line 451. 

Operation 

Initial Set-up by Vendor 

The initial set up oFlhe computer and smart card by a vendor is shown in Figs. 13A, 13B & 13C. Whenever a computer 
which contains this invention is powered on, reset or interrupted 455, the modified BIOS is decompressed and 
downloaded to the main RAM memory of the motherboard 457. As it is connected to a battery, the security engine 
microprocessor is always powdered on. One of the main tlinctions of the modified BIOS is to allow the security engine 
microprocessor to take over control from the CPU 101 on the motherboard. Essentially this is done by placing the 
computer's microprocessor into a continuous loop through the I/O from the main BUS when control is to be passed over 
to the security engine microprocessor 125. 

The BIOS begins a POST (Power On SelfTesl) procedure testing the computer's microprocessor 459, and beginning the 
initialization ofthe hardware 461. At the same time, the security engine microprocessor sets up the encryption and 
decryption procedures to the memory buMer 463, and disables all peripheral circuits except those lor the monitor, 
keyboai d and smart card reader 465. 

Once this process is completed, n check is made ofthe security engine meinor\' to see if the security system had 
previously been set up by a vendor 467. The presence of vendor identiUcatlon data and encryption key length 
information in the Hash memory oftlie security engine indicates this. If it had not previously been set up, a check is 
made to determine ifa vendor t\pe smart card is currently inserted in the smart card reader 133. I Tone is not, a 
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command h sent to the BIOS to display the message 'Mnscrl Vendor Card" 469. 

Upon insertion of any smart ctird into the reader, the security engine microprocesjior begins procedures to synchronize 
communications with tlic smart card 47\. Tiie synchronization process involves the reading ofa block ofdata from tlic 
smart card by tiic security engine. Included in this block ofdata are: the allowed key length for all encryption 
procedures, the smart card register code for the smart card which ideiitiHes tiie type of card it is, the number of 
comnumicalion keys stored in the EEPROM of the smart card, the number of commands which are stored in the look up 
table of the smart card ROM, and a CRC (Cyclic Redundancy Check) check sum. 

Upon receiving the check sum from the smart card, the security engnie microprocessor then creates a CRC matrix in 
order to check for errors in the communications between the smart card and the security engine 473. In this embodiment 
ofthe invention, the preferred algorithm for the CRC is the Hamming algorithm, although one skilled in the art can 
readily see that other algorithms which perform a similar function may be substituted without materially modifying the 
scope or spirit of this invention. During the synchronization of communications between the smart card and security 
engine, the smart card undertakes a check sum calculation in order to check for damaged or erroneous data Fields. If the 
check sum is not correct, the identified areas are reconstructed using data stored in the security engine flash memory. 

This communication synchronization procedure is performed every time a smart card is inserted into the smart card 
reader. In order to secure this initial transfer of data as it passes between the security engine and smart card, a public 
encryption algorithm embedded in the smart card ROM before its delivery to the vendor, is used. Using this encryption 
algorithm, this block ofdata is encrypted by tiie smart card before it is sent to the security engine. In this embodiment of 
the invention, the preferred algorithm for the public encryption key is the RSA algorithm, although one skilled in the art 
can readily sec that other algorithms which perform a similar function may be substituted without materially modifying 
the scope or spirit oFthis invention* 

Subsequent communications between the smart card and security engine are protected through the use ofa dlFferent 
encryption algorithm, such as IDEA, and a unique communication key {CK) which are stored in the smart card and 
security engine memories. 

The CK, which is stored !n the internal memory ofthe smart card and the internal memory ofthe security engine, is used 
as an encryption key with an algorithm lo encrypt or decrypt all communications after the first transfer ofdata between 
the security engine and the smart card. Commands or data encrypted using a smart card\s CK is decrypted by the 
recipient security engine using its CK and visa versa. Only smart cards whicii have the same CK as found in the security 
engine internal nicmory can correctly decrypt the encrypted message and thus communicnie with tbnt computcn 
Consequently, only a smart card and security engine which were personalized together as an individual system ur a smart 
card which was used to create sulwrdinate s>'Slems and tiie sul?ord)nate computers ihe)7iselves can communicate ^^'ith 
each other. 
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When the i-egmlers are read from the smart card to determine the type orcnrd is inserted, an encrypted code number is 
read from the register oFthc inserted smart card and decrypted by the security engine microprocessor using tlic public 
encryption l<ey 475. Tiiis code is then compared to a table ofsmart card code numbers lliat arc stored in Hash memory in 
the security engine 477. From tliis comparison, the type ofsmart card can be ascertained. By default, all smart cards, 
with the exception of vendor smart cards, have the code for a 'new' card in the appropriate register location until 
changed tiirough the set up procedure. 

IFa vendor card is not inserted within a preset number of tries 479, a command is sent to the BIOS to terminate the start 
up procedure 48K At this time, the memory buffer Is erased, and all peripherals with the exception of the smart card 
reader, monitor, and keyboard are disabled. This procedure is performed every time the start up process is terminated. 

This code is compared to a table oFacceptabIc vendor numbers stored in ROM in the security englnCv Once it has been 
ascertained that the inserted smart card is a valid vendor card, all set up routines For the security system are hidden 485 
and the security parameters and vendor identiFication data are read From the vendor smart card and stored in internal 
RAM 487. The security parameters include such things as the maximum key length allowed For encryption procedures - 
a variable that difi'ers From country to country depending on national encryption laws. The vendor card is then ejected 
and a message to insert a new user card is displayed on the monitor 489. 

IFa new smart card (one with no data in the Identification area and indicated by a code in the smart card register) is 
inserted into the card reader, the security engine writes the security parameters and vendor information to the Key 
Management area of the EEPROM of the user smart card 493. The security parameters and vendor data are then erased 
from the security engine RAM 495. The security engine then Waits for instruction 497. Any command received is 
compared to those listed in the command table stored in the ROM memory oFthe smart card 499. More commands may 
be added in the Future if desired. If the command received is a match it is executed by the smart card microprocessor 
50 land it goes in to a wait state once again. At this point; the encryption Functions are totally disabled and all non- 
security related Functions are enabled. The smart card and the computer system can be Fully prepared and tested by the 
vendor For delivery to a customer and to be 'personalized' by that customer. 

initial User Security System Set-up 

Figs. 130 - I3H show the set up procedure for a SAM system. If the security system had previously been set up by the 
vendor, the security engine microprocessor checks for the presence of a smart card in llic attached smart card reader 507. 
IFa smart card is not present in the smart card reader a request to the user to insert a smart card is given via a display 
command sent to the BIOS 509. If a valid one is not inserted within a preset number of tries 511, a command is sent to 
the BIOS that the proper security is not in place and the start up procedure is terminated 513. 
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Ifa smart card is inserted in tiie smart card reader 133 communications are synchronized between It and the security 
engine 515, a CRC matrix is created 517 and (he identincation code register is read Iroin the smart card 519. 

Following this, the smart card idcntillcalion code is chocked to determine Whether or not it is a new user type smart card 
521. "I'his is determined by the presence oFcncryptcd code numbers in the Key Management area ofthe smart card 
memoiy which indicates tliat the card is 'new' and a *user' smart card. 

IF it is a new user smart card, a check is made by the security engine to determine if any personal identification data or 
security configuration parameters are stored in their respective areas ofthe Hash memory 523, If tliere is, the start 
procedure is terminated 524. IFtiiere is neither, this indicates that the system has not yet been 'personalised' and this 
procedure is initialed. 

In the first step ofthis procedure, the encryption key length parameter is read from tlie Key Management area ofthe 
smart card memory 525. As previously noted, this parameter is loaded into the vendor smart card during its manufacture 
and varies from country to country. This key length ultimately determines the strength ofthe encryption algorithms used 
hi this invention. 

Following this, another command is sent to the BIOS to display the user identification set up screen 527. This screen 
displays a unique serial number assigned each security motherboard during its inanufacture and allows the user to input 
personal information to be used to ^personalize' each computer and smart card 529. The personal inlbrmation can 
include such items as the user's name, address, phone number, a credit card number, a one-time password and other 
inlbrmalion. At this point control is passed back to the BIOS which instructs the security engine microprocessor to read 
the information inputted by the user and write this data to a CMOS (Complementary Metallic Oxide Semiconductoi-) 
table in the scratch memory ofthe security engine 531. If the entry ofthe personal identification information is 
completed 533, the information inputted by the user is also vVritten to a look up table in the Identification area in the 
internal memory ofthe inserted smart card 535. Some of this personal data may be changed at any time although this 
requires the insertion oFan auiliori^ed smart card and a Further check oFthc identity oFthe individual requesting the 
change such as by the entering of certain key information known only to the authorized individual user such as a 
password or some personal identification number. 

AHer the user has inputted all the data required by the identification set up screen and the information has been stored in 
both the smart card and security engine memories, a command is then sent to the BIOS to display tiie security 

configuration set up screen 537. Through this screen, the usci- can set (lie level and type of security for tlie SN'steni. This 
includes such parameters as the specific peripheral devices to be enabled in the SN^^teni as Well as the designation ofthe 
s\'stcin as a Stand Alone Mastei", Master/Slave or Slave, As with tlie identification set up screen, the securit}' 
configuration inrornralion inputted b\' the ttser 539 Is written to tiie CMOS table in the security engine scratch memory 
buiterand also to the /dentincatioii area ofthe internal inemoi'N^ ofthe inserted smart card 541. 'fhis sccurits^ 

27 


wo 02/33522 


PCT/IBOO/01659 


conilgiiraUon data can also be changed iftlie proper authorization is given. 

Once all the user inputted data has been written to the scratch memory 543, tlie security engine microprocessor writes a 
boot load subroutine 545, whicli is stored in the flash memory, to the internal RAM of the microproccsson The boot 
load subroutine contains software oFall the procedures necessary to burn the data stored hi the scratch memory to llie 
flash memory^ Every time the programming circuit is required to burn data from the scratch mei7iory to the security 
engine flash memory, this boot load program is created. 

By default, the initial user set-up procedure involves the designation of the Hrst new smart card and computer as a 'Stand 
alone Master' (SAM). If a new card is designated to be a SAM, the identification code for a SAM is written into the 
command register of the smart card 547 and the SAM set up procedure is initiated by the security engine microprocessor 
549v Next, using the personal information that was previously entered by the user, the hash numbers W 1, H2, and H3 are 
calculated by the security engine microprocessor and stored in its scratch memory 55L As previously noted, the 
prelerred algorithm used to produce these three hash numbei's is HavaK 

The security engine microprocessor then generates a communication key from H2 it had created and stores it in the 
scratch memory 553. As noted, the preferred algorithm used to produce this key is IDEA, although one skilled in the art 
can easily see that a similar algorithm may be substituted without materially changing the spirit or scope oFthis 
Invention. 

Within the smart card, the same algorithm as used by the security engine microprocessor, is used io generate a set of 
three hash numbers HI, H2 and 1-13 555. After this, by applying a linear congruency function algorithm to HI, H2 and 
H3 in the smart card, new hash numbers H 1 \ H2' and H3' are calculated 557. These three hash numbers are then stored 
in the Key Management area of the smart card 559. 

These unique hash numbers are used to check if a particular smart card is authorized for use With a particular computer. 
For example, before granting access to the holder of a particular smart card, the security engine compares the HI and H3 
hash number read from the security engine to the H I ' and 1-13' hash number read from the inserted smart card. As both 
the smart card and security engine contain the same linear congruency function which was applied to the security engine 
hash numbers (Hx) to generate the smart card hash numbers (Mx'), it can easily be determined if the two hash numbers 
are complements. If these two hash numbers arc complements, access is allowed to the computer up to the level 
previously determined in the security contlguralion. 

Next, the smart card microprocessor applies an algorithm to the hash number M2' to generate a communication key 
(CK) to be used in the encryption and decryption of all communications between tfie security engine and the smart cnrd 
561 . This key is also written to the Key Management area of the EtIPROM of the smart card 563. 
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Al the same lime the smart card microprocessor Is generating the new I-I I \ 1-12' and 1-13' ha$h numbers and creating the 
key for encrypt iiig communications, the security engine sets up the programming circuit for l^urning the communication 
encryption key and prime hasii numbers and otlier information such as the security conllguration and identiMcation data, 
to the Hash memory of the security engine. This preparation involves tlie security engine microprocessor writing the 
entire contents of the Mash memory to the scratch memory 565 and generating the boot load subroutine necessary to burn 
the flash memory and the internal memory of the smart card which is inserted in the smart card reader 567* Once this 
preparation is complete, the security engine enters an 'automatic programming' mode and writes data to the security 
engine and smart card internal memories 569 as foilowsv 

First, the security engine communicates the start of the auto-burn procedure to the smart card which is inserted in to the 
smart card reader. This is caused by setting the line PAO 138, which connects the security engine microprocessor 125 
and the smart card reader 133, to 'High\ Upon receiving this signal, the smart card microprocessor 125 sets the PB3 line 
149 which is connected to the voltage regulator 145 to M-ligh\ Physically, this causes the PB3 line 149 to be set to 5 
volts. This causes the VPP line 151 which is connected to the security engine microprocessor 125, to lOV. Through the 
Read and Write lines w^hich logically connect the scratch memory 127 and the security engine microprocessor 125, a 
read or write signal is sent by the microprocessor 125 to the memory 127. If it is a read signal, the data which is stored in 
the scratch memory 127 is burned to the flash memory of the security engine microprocessor 125 following the 
procedure provided by the boot load subroutine. Addresses required for this burn procedure are produced by the TTL 
latch device 147 and are transferred through the address lines which connect the latch device 147 to the scratch memory 
127 and the microprocessor 125. Similarly, data is transferred through the data lines which are between the scratch 
memory and the security engine microprocessor* When new data is burned to the tlash memory, any data previously 
stored in the flash iTiemory is erased. When the auto-burn procedure has been completed, the security engine 
microprocessor 125 sets line PAO 138 to 'Low' (OV) to signal its completion. The security engine microprocessor 125 
then resets the programming ch-cuit 129, the scratch memory 127 is cleared, and normal operations resume. 

Whenever a new user system is set up, immediately after the creation of the SAM, MS or Slave smart card, a repair card 
IS created. Upon termination of the program to create the system smart card, a command is sent to the BIOS instructing 
the user to insert a repair card 571* Upon insertion of iJie card 571, the security engine calculates H2 from tlie H2' stored 
in the scratch memory of the security engine 573. Then, an algorithm is used to transform this hash number In the smart 
card to M2' 577 \\*hich is then written to the Key Management area of the repair smart card 579, Employing an 
algorithm, the hash number, 1 12' is used to generate a communication key (CK) to provide encryption of all 
communications between the security engine and the repair card 58 L This key is also written to the Key Management 
ai ea of the repair card 583. 

Once the pi'ocedure to create a repair card is complete the contents of the scratch memory arc erased 585. *fhen a request 
to reinsert the newly created SAM card is made 587. Hext, all allowed peripherals are read from the security 
configuration table stored in the securit\^ engine flash memory and arc enabled 589. iHillowing this, a conimand is sent to 
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the BIOS to install the operating system (0/S) kernal and begin loading ofthe 0/S 
Subsequent Set-up of Subordinate Systems 

If, during the start up procedure it is determined that the computer had not previously been personalized, as indicated by 
the absence oF personal identification data in the security engine flash memory 593, and that the inserted smart card is 
\ised' 52K as indicated by the presence of a 'used' code in the smart card register, a procedure to create a subordinate 
system using this inserted smart card can be initiated. The procedure for creating a subordinate system is shown in Figs. 
131 ^ 13M. 

However, a check must first be made to determine if the inserted smart card is a vendor card 595. If it is, the security set 
up screen must be disabled 597 as well as the identification set up screen 599. Once this is done, all periplierals are 
enabled 601, the operating system is loaded 603 and the computer waits for instructions 605. This procedure is shown in 
Fig. 13D. 

If the smart card inserted in the smart card reader is not a vendor smart card, the procedure to create a subordinate 
system is available 607. If this procedure is not initiated at this point, the start up process is terminated 608. 

A SAM card or a Master/Slave card can create subordinate 'Master/Slave' (MS), or ^Slave' systems and both are 
referred to as a 'Master' card for this procedure. If a SAM or MS Master card is inserted in the smart card reader 609 
and the option to create a MS subordinate system has been chosen 611, tiie following steps are taken. First, (lie hash 
number H2' is read from the Master card 613 and written to ihe scratch memory ofthe security engine 615. U'sing the 
same algorithm used by the smart card to generate the H2' number, a hash number H2 is derived from H2' 617, 

At this point, a command is sent to the BIOS to display the identification set up screen 619 and the user is instructed to 
input the appropriate information 621. This personal data is then written to the Identification area ofthe Master smart 
cat d meiTiory and the scratch memory ofthe security engine 623. Wlien this is completed, the security configuration set 
up screen is displayed 625 and security configuration parameters inputted by the user 627. These parameters arc then 
written to the security engine scratch memory and the Master smart card internal memory 629* 

Following this, two new hash numbers H 1 and H3 are created by the secunty engine microprocessor using the personal 
information previously inputted by the user 631. Using an encryption algorithm on the previously derived H2, the 
secunty engine creates a CK 633. The two hash numbers HI and H3 and the communication key (CK) are then written 
to the scratch memory bulTer and tiie internal memory ofthe Master smart card 635. "fhe storing ofthe subordinate 
system's hash numbers and communication key in the Master card's internal memory gives the Master smart card full 
access to the subordinate system. 
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The Master smart card is tiicn ejected from tlic reader and the user is instructed to insert a new card 637, Once a new 
smart card has been inserted, the identHlcation and security configuration data are written to the intcrnaf memory oFthe 
inserted smart card 639. [fa new user card is designated to be a Master/Slave card, the identification code for this type 
oi'card is written into tiie command register of the smart card 641 and the set up procedure for the type ofcard to be 
created is implemented. 

An algontlim stored in the smart card microprocessor is then used to generate the hasii numbers W I and H3 from the 
personal identification data stored In Ihc Identification area of the smart card 643. Using a linear congruency function, 
tiiesc hash numbers are transformed into HT and H3' 645. Following this, the hash number H2, which was previously 
read from the Master smart card and written to the security engine scratch memory, is written to the internal memory of 
the inserted smart card 647. An algorithm stored in the smart card is then used io generate a new hash number, H2' from 
H2 649. Tlic preferred algorithm used to produce this hash number is a linear congruency function such as XOR 
although one skilled in the art can easily see that any similar algorithm may be substituted without materially changing 
tlie spirit or scope of this invention. Hash number H2' is transformed through the use of an algorithm to generate a 
communication key (CK) 651. Hash numbers HF, H2' and H3' and the communication key are then written to the Key 
Management area of the subordinate system smart card memory 653. Wash numbers HP, l-W and H3' and the smart 
card communication key are tiien written to the scratch memoi7 of the security engine 655« 

Next, the entire contents of the security engine flash memory is written to the scratch memory. The programming circuit 
is prepared 657 as previously described and the data In the scratch memory is burned in to the internal flash memory of 
the security engine through use of tlie programming circiui 659. 

The new system smart card is ejected and the user requested to insert a 'Repair' card 66 L When a valid Repair card is 
inserted, a hash number H2 is generated from the W2' stored in the scratch memory of the security engine 663. H2 is 
then written to the Key Management area of the Repair smart card 664. The Slave smart card microprocessor next 
creates W2' fro27-i this M2 using an algorithm such as the linear congruency function 

665 and then generates a CK from this H2' employing another algorithm such as IDISA 667. 

The repair card is then ejected and a request made to insert the subordinate system smart card 669. l^ollowing the usual 
synchronization and authentication routines, the scratch memory is erased 671, all allowed peripheral devices are 
enabled according to the parameters set In the security conllguration table 672 and the operating system is loaded 673. 

Using this procedure a hierarchy of Masler/Slave systems can be created, each accessible by the card which was used to 
create it and the new card created as part of the systenu 

A SAM and MS card are also capable ofcrcating a Slave system comprised of a Slave computer and Slave smart card. 
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The procedure for this is as Ibllows. 

Ph'si, hash numbers Hl\ H2\ 113' and CK are read from the Mastercard 675 and uMittcn to the scratch memory ofthe 
securiiy engine 677* Next, the identiflcnlion set up screen is displayed 679 and persona! identification data is entered by 
tiie user 681 and written to the scratch memory 683* Following this, the security configuration parameters arc read from 
the Master smart card 685 and also written to the scratch memory 687. The SAM or MS smart card is then ejected from 
the reader and the user is instructed to insert a new smart card 689. In tlie creation ofa Slave system, as in the previous 
set up routine for a SAM or MS system, the identification code for this type oFcard is written into tlic command register 
ofthe new smart card 69 L 

The three hasli numbers I-Il \ 1-12' and H3\ the CK are written to the Key Management area ofthe smart card memory, 
and the identification data and security configuration parameters are written to the Identification area ofthe smart card 
through the programming circuit 693. Tlie programming circuit is tlien prepared for burning tiie flash memory 695 and 
the contents ofthe security engine flash memory arc then written to the scratch memory 697 and all the data in the 
scratch memory is burned to the security engine flash memory 699. 

The new^ system smart card is ejected and the user requested to insert a 'Repair' card 70 K When a Repair card is 
inserted, the security engine calculates H2 from the H2' stored in the scratch memory 703. Next, M2 is written to the 
Key Management area ofthe Repair smart card 705* Then, using an algorithm, tlie smart card transforms the H2 to I-I2' 
707. The Repair card microprocessor next creates a CK from H2' 709 which is used in any subsequent communications 
between the Repair card and its matching subordinate Slave computer* 

The repair card is then ejected and a request made to insert the subordinate system smart card 71 L Following the usual 
synchronization and authentication j-outines, the contents ofthe scratch memory are then erased 713, all allowed 
peripheral devices are enabled 715 and the operating system is loaded 717. 

Normal Operating Procedure (After Set-up by Vendor and User) 

Figs. 13N, I30 & I3P sliovs' the normal operating procedure for a computer system containing tlie present invention 
once it has been fully set up. If the computer containing the present invention had previously been set up l)y a vendor 
467 and a valid, previously set up smart card is inserted in the smart card reader 521, and there is personal identillcation 
data in the security engine 593 the smart card registers are read to determine ifthe inserted smart card is a 'vendor', 
Hiser\ or 'lepair' type sniart card. 

Ifthe card is ofthe ^vendor^ type 718. the security engine microprocessor determines if it is a valid vendor type smart 
card 719. ifthe decrypted code does not match those assigned to vendor cards, the start Up procedure is terminated 721. 
If it is, a command is sent to the I3I0S to hide the security set up routine 723 and the personal identification set up 
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routine 725. Then a coinmnnd is sent to the BIOS instructing the user to insert a user or repair card 727, 

Ifllic subsequently inserted smart card is a user smart card, communication is synchronized between the inserted smart 
card and tlic security engine as occurs every time a smart card is inserted in the smart card reader 729. Ne?it, H 1 ' and 
I-I3' hash numbers are read from the smart card 731 and HI and H3 hash numbers arc read From the security engine flasli 
memory 733. The smart card Ml ' and H3' are then compared to the security engine^s HI and H3 735* The preferred 
algorithm for this authentication procedure is the Glllou-Quisqualer scheme although one skilled in the ait can easily see 
that a similar algorithm may be substituted without materialiy changing the spirit or scope of this invention. If a match 
does not exist, the memory buffer is erased, ad peripherals except the monitor, keyboard and card reader are hidden and 
the start up procedure is terminated 737. If the hash numbers in the smart card and security engine memories do match, 
the security engine miGroproccssor reads tlie security configuration parameters from the flash memory 739 and all 
allowed peripheral devices are enabled 74L Following this, the operating system is loaded 743 and the system waits for 
further instructions 745. 

If the code register indicates that the inserted smart card is a 'repair^ type smart card 747, a process to authenticate the 
repair card is initiated. If the inserted smart card Is not a repair card, the start up process Is lermintaed 749. For the 
authentication procedure of the repair card, the H2' hash number Is read from the smart card 751 and H2 is read from 
Ihe security engine 753. These two hash numbers are then compared and if they arc found to match 755, the index of 
hidden files are read from the repair card 759 and all the files in the index are hidden before the start up procedure 
continues 761. If a match is not found, the start up is terminated 757. Follow^ing this, the security configuration 
parameters are read from the security engine memory 763, all allowed peripheral devices are enabled 765, the operating 
system is loaded 767 and the system waits for further instructions 769. 

If it is ascertained that a valid, previously set Lip, 'user' card has been inserted 77 K the security engine microprocessor 
initiates an identification procedure. This procedure involves checking to see if the inserted smart card is authorized to 
operate that particular computer. The hash numbers HI " and H2' stored in the Key Management area of the smart card 
are read by the security engine 773 and H 1 and H2 are also read from the security engine memory 775. These two sets of 
hash numbers arc then compared using an algorithm stored in the security engine flash memory 777, The preferred 
aJgorithm for this authenticalion procedure is the Cillou-Quisquater scheme although one skilled in the art^ caii easily see 
that a similar algorithm may be sul'jstituted without materially changing tiie spirit or scope of this invention. 

If a match does not exist, a check is made of other hash numbers possibly stored in the Key Management area of the 
smart card to see if the smart card inserted is the Master smart card whicii created the system. If no match is made, the 
start up procedure is terminated 779, 

If a match docs exist and all security procedures are determmed to be in place, a check is next made to determine if any 
changes are to be made to the identtncation data or the seeurhy configuration parameters 78 1. If none are to be made, a 
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command is sent to the BIOS to read the security connguration look up table stored in the Hash memory oFthe security 
engine 783. Tht^ BIOS then calculates which peripherals are nllowed to be loaded by checkhig the appropriate entry in 
the security conllguralion table ofthe security engine. The BIOS next enables all allowed peripliernls through the 
enable/disable circuits and docs a sell' test oHhese peripherals and the main BUS 785. A check is then made for system 
errors. Following Ihis, the BIOS sends a ready command to the security engine. The BIOS then sets up the real time 
encryption and decryption procedures for all selected peripheral devices such as data storage devices or data 
communication devices 787, Finally, the BIOS kernel which contains tlie address for the operating system is installed 
and the first entry to the operating system, which is stored in a data storage device on the computer, is retrieved, the 
operating system loaded and the computer ready to operate 789* 

Changing of Personal Identification Data and Security Configuration: 

The procedure for changing the personal identification data or the security configuration parameters is shown in Figs. 
!3Q, 13R, 13S, 13T & 13U- During the boot phase ofthe computer's start up procedure, the personal inrormation and 
security configuration stored in both the security engine and smart card memories may be changed if the proper 
authorization is provided 791. If the proper authorization is not given, the start up procedure is terminated 793. 
Optionally, changes to the Identification data and security set up could require the additional security feature of a 
password or PIN (Personal Identification Number) number. If during the boot phase, a specific key on the keyboard is 
pressed, a routine will be miplemented which will allow the display and changhig ofthe Identification data and security 
configuration if the proper smart card has been inserted* Through this, the system configuration may also be changed 
such as wlien a peripheral is to be removed or added to the system. Vendor and repair cards, as they contain no personal 
identification data, cannot be altered. 

SAM systems can have the personal identification and configuration information changed only ifthe SAM card which 
matches the SAM computer is inserted in the card reader. An MS system's identification data can only be altered ifthe 
SAM or MS card tlial was used to create that particular MS system is present. The Identification data in a Slave system 
can only be changed ifthe MS or SAM card which was used to create that Slave system is inserted in the system's smart 
card reader at the time the changes are to be made. 

When tiie appropriate key is pressed during the boot phase ofthe computer, a check is made to see ifthe Master smart 
card which was used to create the system is inserted in the smart card reader. If it is not, a command is sent to the BIOS 
to display a message to insert the 'Master' card 795* If it is inserted within a preset number of tries, the information 
change procedure is continued. Next, after communicalions between the computer's security engine and Master smart 
card are synchronised the set up screen to be changed is determined. 

Ifthe security connguralion h to be changed 797, 11 is displayed 799 and the user inputs any new paramelcrs. This new 
data is then wrillcn to Ihe scratch memory ofthe sccurily engine 801. and when all the cliangeshave been entered, the 

34 


wo 02/33522 


PCT/IBOO/01659 


procedure lo burn this new data to the Hash memory is initialed. As was previously described, tliis involves the writing 
ofall data stored in tlie Hash memory to the scratch memory 803, tiie setting up oftlie programming circuit 805 and the 
writing of the data in the scratch memory lo the (lash memory 807. The new data is also written to the Master smart card 
809, A command Is then sent to the BIOS to insert tiic system smart card 81 1 and tlie new security configuration is 
Written to this smart card 813. According to the parameters ofthe new security conllguration, all allowed peripheral 
devices are enabled 815 and tiic operating system loaded 817. 

Ifpersonal information data is to be changed 819, a command is sent to the BIOS to display the personal identification 
screen 823. If neither the security configuration parameters or the personal identification data are selected to be 
changed, the start up is terminated 82 L If the personal identification data is to be changed, a password may need to be 
entered in order to proceed with the change routine. If the authentication procedure is successful, changes can be made 
to the identification data and are written to Ihe appropriate security engine look up table in the scratch memory ofthe 
security engine 825 and the internal memory ofthe inserted Master smart cardv The next steps In this procedure depends 
on whether the system being changed is a SAM, MS or Slave system, 

I fit is a SAM system, the same procedure as for the original set up of a SAM system Is initiated 827, The first step in 
this process is the calculation of hash numbers HI, H2, and H3 from the new identification information 829. Using an 
algorithm on I-I2, a CK is calculated 831. These three hash numbers and the CK are stored in the security engine scratch 
memory in preparation for later burning to the flash memory. Following this, the entire contents ofthe security engine 
flash memory, including the identification and security configuration lookup tables, are written to the scratch memory 
along with the new hash numbers and CK 833. This data in scratch memory is then written to the Mash memory ofthe 
security engine microprocessor through the use ofthe programming circuit 835v 

Next, in the inserted smart card H 1 , H2 and H3 are calculated using an algorithm stored in internal memory 837. These 
three hash numbers are then changed to H 1 \ H2' and H3' through the use ofthe linear congniency algorithm stored in 
the Key Management area ofthe smart card memory 839. From H2\ using the IDEA algorithm, a CK is calculated 84K 
These I-Ix' hash numbers and Ck are then written to the Key Management area ofthe smart card 843. 

These new H 1 \ M2^ and H3^ numbers stored in the smart card take precedence over any hash numbers currently stored 
in internal memory. The new communication key generated also takes precedence over the old communication key. In 
order to enable communications with subordinate systems which were set up using the *old' CK and hash numbers, the 
H^ld' CK and hash numbers remain in both tiie smart card Key Management area and in the Hash memory ofthe security 
engine. Due lo the storage oflhe hash numbers for subordinate systems in the Key Management area, any changes made 
to the SAM card will not affect Us ability to access and operate subordinate systems which it created. 

Once these clianges to the system security engine and Master smart card have been made, a command is sent to the 
BIOS for the user lo insert the repair card in to the smart card reader 845. If the proper repair card is inserted in to the 
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smart card reader, the M2 liash number stored in the Hasli memory ofthe sccuriiy engine microprocessor is written to the 
repair smart card. Using a linear congruency algorithm, the hasii number 1-12' is then calculated 849. The IDEA 
algonllim is tiien used on M2' to generate a repair card CK SSL Tlie M2' and CK are next written to the Key 
Management area ofthe repair smart card 853« Following this, the contents ofthe scratch memory are erased 855, the 
repair card ejected from the smart card reader and a request to insert the SAM card is displayed 857. When the correct 
SAM card is inserted into the smart card reader, aficrthe synchi'onlzation procedure, the security conMguration 
parameters arc read by the security engine microprocessor 859, all allowed peripherals are enabled 861, and the 
operating system loaded 863, 

IF changes are made to the personal identification data oPan MS system 865, once the changes have been entered, the 
security engine microprocessor creates new H 1 and H3 hash numbers from this information 867. These two hash 
numbers are written to the scratch memory ofthe security engine 869 and the internal memory ofthe Master smart card 
inserted in to the smart card reader 87L The 1-12 hash number remains the W2 from the Master card that was originally 
used to create the MS system. The Mastercard is then ejected and a request to insert the system smart card is displayed 
873. When the system MS card is inserted into the card reader, the new identification information is written to the smart 
card 875 and new hash numbers HI and H3 are calculated using an algorithm stored in internal memory 877* Using 
another algorithm, H 1 ' and M3' are generated from H 1 and H3 879. H2' remains the one which was originally created 
from the Master card H2i. The new H P and Hj' are written to the Key Management area ofthe system smart card 881. 
As Hie H2 and H2' are the same as before, the communfcaHon keys and the iiash number stored in the repair card are 
also unchanged from those previously generated. Once the system smart card is updated, preparation for updating the 
system security engine flash memory with the new identification information and hash numbers is begun. This Involves 
the w^riting ofthe contents ofthe flash memory to the security engine scratch memory 883 and the burning of this data 
and the new data back to the flasli memory 885. The scratch memory in the security engine is then erased, the security 
configuration parameters read by the security engine microprocessor and all allowed peripherals enabled 887, Finally, 
the operating system is loaded 889. 

Changes also may be made to the identification data of a Slave card 891, but as the set of hash numbers are taken 
directly from the Master system which created it, this will not alter the Slave system's hash numbers or communication 
key. If it no changes are to be made to the system, the start up procedure is terminated 893. Any new data is written to 
the Idcnliilcation area ofthe Master card that created the Slave system 895, and to the scratch memory ofthe Slave 
computer 897. The system is then prepared to burn the new information to the flash memory. First the contents ofthe 
Hash memory are written to the security engine scratch memory 899, and this data and the new identiilcation information 
are burned to the Hash memory 90L 'fhe Master card is then ejected and a request to insert the system Slave smart card 
is displayed 903, Upon the insertion of tiie correct Slave card the new identiilcation data is written to the Identification 
area ofthe Slave smart card 905, Next, the security configuration parameters are read by the security engine from the 
Hash memory, all tiUowed peripheral devices are enabled 907, and the operating system loaded 909. 
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Repair Card Operation 

The nonnni opcratiiiL^ procedure for a repair card is shown in Fig. 13V, Ifduring the start up ofn system containing the 
present invention it is determined l:iiat tlie vendor set up procedure had previously been completed 467, a Hised' smart 
card is inserted in the smart card reader 521, the computer system's set up procedures had been pei formcd 593, and that 
the inserted smart card is not a vendor 718, or user smart card 771, a check is made to determine iFtiie register code is 
for a repair smart card 91 1. If' it is not, the start up procedure is terminated 913. 

If the smart card register indicates that the inserted smart card is a repair card tlie First step is the reading of the hash 
number W2' from the repair card 915. Next; H2 is read from the flash memory of the securiiy engine 917. These two 
hash numbers are compared by the security engine microprocessor using the Gillou-Quisquater algorithm 919 and if they 
do not match, the startup procedure is terminated 92L IFthey do match, tlie list of liidden tiles stored in the internal 
memory of the smart card is read 923 and all restricted files are hidden 925. Next, the security parameters arc read from 
the security engine Hash memory 927 and all allowed peripheral devices are enabled 929. The operating system is then 
loaded and the computer waits for instruct"ions 93L 


Real Time Data Encryption/Decryption (ISA): 

Upon receipt of the command to encrypt or decrypt some data, the device driver for the peripheral which is involved in 
this operation and that received this command creates a header that contains the specific parameters for this task. The 
device driver tlien sends tliis header to the circular memory buffer through the ISA Bus. This memory buffer for the ISA 
Bus is depicted In Figs. 1 1 A and 1 IB. When an I/O read or write procedure that requires encryption is encountered by 
the device dnver(s) involved, a signal is sent to the PAL 332 through the ISA Bus 333, setting up a particular address In 
the PAL. This address causes the HEADERJ-lANDSHAKE line 359 to be asserted. This signal goes to the security 
engine microprocessor 125 interrupting the microprocessor and causing it to read the header previously placed in the 
circular memory buITen With this header information, and the encryption parameters set previously by the user and 
stored in the security engine internal memory the encryption or decryption procedure is performed l^y the securiiy engine 
microproccijsor. 

Utilizing the parameters set by the header, the security engine microprocessor reads data liom the circular memory 
bulTer, ifavailable, then encrypts or decrypts the data as required. This data is then written lo the circular memory bulTer 
and then sent on to the appropriate peripheral device. 

When an 1^0 write procedure is asserted through the ISA Bus a CSWR (chip sclecl write) signal which goes through 
line CSWR 375 is generated by the l/Q Address Mapping PAL IC. When an LO read procedure is asserted through the 
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ISA Bus a CSRD (chip select read) signal is generated through the CSRD line 381, At the same time, a signal is sent to 
the RD^STATUS line 345 setting ft to Low enabling (he status ofthc circular memory buHer to be checked. Upon the 
generation ofa CSWR or CSRD signal, the device driver that originally initiated the 1/0 read or Write procedure checks 
to see ifthe circular memory bulTcrs involved are empty or full through the RD_STATUS line 345. This information Is 
sent to the device driver layer through the data Bus 387 of the ISA Bus. The four status Hag lines 
SEC__ENGINE_RD_EMPTY 365, SEC_ENGINE_RDJ-ULL 393, SEC_ENGINE_WR_EMPTY 397, and 
SEC_ENGINE_WR_FULL 367 connected to the two pairs of read and write circular memory buffers 363, 383, & 377, 
379 allow the security engine microprocessor 125 to obtain the memory status oFtlie circular memory buffer and decide 
to proceed or wait as required* 

If an I/O read procedure was initiated by a device driver and the RD__STATUS 345 returns thai the two circular memory 
buffers designated for read procedures are empty, the device driver enters into a wail state until data is in the circular 
memory buflen Wlieji data is ready to be transmitted by the security engine to the circular memory buffer, the line 
SEC_ENGINE_WR (security engine write) 391 is set to Low by a pull up resistor and the data written to the circular 
memory buffer by the security engine. This data comes from the security engine through the DO lines 389. The data may 
have been encrypted or decrypted in the security engine depending on the setting chosen^ If data is available to read, the 
PAL of the 1/0 Address Mapping circuit 332 asserts the IOCS 16 line 341 and generates a 16 bit data transfer signal and 
data is sent from t!ie circular memory buffer, through the SD lines 387 of the circular memory buffer to the ISA Bus and 
then to the device driven 

If an I/O write procedure was initiated by a device driver and the RD_STATUS 345 returns that the two circular 
memory butTer designated for write procedures 377, 379 are full, the device driver enters into a wait state until there Is 
space in the circular memory buffer for more data. Wheri data is ready to be transmitted to the security engine Irom the 
circular memory buffer, the line SEC_ENGINE_RD (security engine write) 395 is set to Low by a pull up resistor and 
the data read from the circular memory buffer by the security engine. This data goes to the security engine through the 
DO lines 389. The data may then be encrypted or decrypted hi the security engine depending on the setting chosen. If 
space in the circular memory bufTer is available to write, the PAL of the I/O Address Mapping circuit 332 asserts the 
IOCS 16 line 341 and generates a 16 bit data transfer signal and data is sent from the circular memory buffer, through the 
SD lines 387 of the circular memory buffer to the ISA Bus and then to the device driver. 

Real Time Data Encryption/Decryption (PCI): 

When a write or rend procedure which requires encryption or decryption of data which is transferred through the PCI 
13us> the device driver which received this command, generates a read or write register at address DxCOOOOOOO in the 
local Bus. This is performed through the PCI Bridge to Local Bus Interface IC 137 of Fig. 12 and is sent to the 
programmable device 14 1 through the Local Bus Address line 407^ Up to eight bits of command data are sent to this or 
any other address on the programmable device through the ID ((L..7] line 405. 
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Ifit is a wn(c procedure, which is indicated by a write command at address OxCOOOOOOO sent to the programmable 
devtcc by the device driven the programmable device 1 41 next checks the $!2CJSNGINIS_WR_FULL line 439 to 
ascertain the memory status ofllic WRITE circular memory buffer 139ik IIMhis line is set to I=ligh C5V), this indicates 
tiiat the WRITB circular memory buFfcr is not full and therefor the write procedure may proceed. The data to be written 
is passed from the computer RAM 107, through the PCI Bus 108 to the PCI Bridge to Local Bus Interface IC 137. It is 
then passed through the Local Bus 405 to the programmable device 141 and to (he WRITE circular memory buffer 
139a. This data is then passed on to the Security Engine microprocessor 125, through the SEC_ENGINE_DATA_BUS 
line 445. where it is encrypted or decrypted as required and then passed back through the SEC_ENGINE_WR line 451 
to the READ circular memory buffer 139b. This data is then passed to the PCI Bridge to Local Bus Interface IC 137 
through the ID line 405. From here, the data can enter ihc PCI Bus 108 to go where the procedure requires. 

Iftiie SEC_ENG1NE_WR„_FULL 439 line is set to Low (OV), this indicates that the WRITE circular memory butler 
i39a is full and therefor the device driver enters into a wait state until there is memory space in the circular memory 
buffer for data to be passed. A setting of Low on the SEC_ENGINE_WR_FULL line 439, causes the WRITE^FULL 
line 431 of the L_INT line 423 in the Local Bus to be set to Low. This triggers an interrupt signal which travels through 
the PCI Bridge to Local Bus Interface IC 137 to the PCI Bus 108 and back to the device driver. The device driver then 
enters into a wait state until the interrupt signal is no longer being received. 

If it is a read procedure, which is indicated by a read command at address OxCOOOOOOO sent to the programmable device 
141 by the device driver, the programmable device checks the SECURITY_ENGINE_RD_EMPTY Vine 449 to ascertain 

if the memory status of the READ circular memory buffer I39b. If this line set to High (5V), this indicates lliat the 
READ circular memory bufler is not empty and therefor the read procedure may proceed. The data to be read is passed 
from the peripheral device where it resides, through the PCI Bus 108 to the PCI Bridge to Local Bus Interface IC 137. It 
is then passed through the Local Bus ID line 405 to the READ circular memory buffer 139bv This data is then passed on 
to the Security Engine microprocessor 125, through the SEC_ENGINE_DATA_BUS line 445, where it is encrypted or 
decrypted as required and then passed back through the SEC_ENGINE_RD line 443 to the WRITE circular memory 
buffer 139a. This data is then passed to the PCI Bridge to Local Bus Interface IC 137 through the ID line 405. From 
here, the data can enter the PCI Bus 108 to go where the procedure requires* 

irthe SECJ3NGINE_RDJZMPTY line 449 Is set to Low (OV), this indicates that the READ circular memory buITer 
1391) is empty and therefor the device driver enters into a wait state until there is data in the circular memory buffer to 
be read by the device driver. A setting of Low on the SEC_ENGINE_RD_EMP"fY line 449. causes the programmable 
device 141 to set the READ_EMPTY line 430 in the Local Bus to be set to Low. This triggers an interrupt signal which 

travels Ihrough the PCI Bridge to Local Bus Interface IC 137 to the PCI Bus 108 and back to the device driver. The 
device driver then enters into a wait slate until the interrupt signal is no bnger being received. 
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Personalized Encryption: 

As previously noted, tiiis invenlion can be used to encrypt data for receipt by anotlier computer containing tiiis invention 
which can only be decrypted by the recipient system and no otiier. This involves the modincationsi to the DDL^ wliicli 
allows for ihc creation ol'a unique header tor the data to be sent to another system. This header contains the size of the 
plaintext to be encrypted, or the size of the encrypted code to be decrypted; tlie type of operation to be performed — 
whether involving a storage device, network or modem; the number of plaintext divisions required given the circular 
memory buffer capacity and a parameter from the personal identification data from the target computer as well as its 
unique serial number. 

Upon receiving a call from an application to prepare (encrypt) data for receipt by another computer containing this 
invention, the modifications to the DDL cause it to create a unique header as described previously. This header, along 
with the data to be encrypted, is written to the FIFO of the Circular Buffer and read by the security engine 
microprocessor to the security engine scratch memory buffer. The procedure for this follows that for real time 
encryption/decryption as previously described for this invention^ The security engine microprocessor then uses the 
header information as a key in an algorithm to encrypt the plain text data. The preferred algorithm for this is IDEA 
although one skilled in the art can easily see that an algorithm that performs a similar function may be substituted 
without materially changing the scope or spirit of the invention. 

Next, the header and the encrypted data are encrypted through the use of the pubh"c key encryption algorithm. The 
preferred algorithm for this is RSA although one skilled in the art can easily see tharan algorilhm that performs a similar 
function may be substituted without materially changing the scope or spirit of the invention. Once again rollowing the 
procedure as described for real time encryption/decryption foi' this invention, the encrypted header and data are written 
to tlie FIFO of the circular buffer and to the pei'lpheral device as directed by the DDL. 

Upon receiving the encrypted data and header, the DDL of the target computer, when it receives the call to read and 
display this encrypted package, writes iflo the security engine scratch memory buflbr through the circular buffer. In the 
scratch buffer, the header and data are decrypted using the public key algorithm stored In the Internal memory of the 
security engine^ 'f his results in a header which is completely decrypted and the data block which is still encrypted with 
the header key. 

In order to check il"lhi$ data was intended for the recipient computer, the CMOS table containing the target computer's 
personal identification Information is written to the scratch memory bulTer of the security engine, 'fhe security engine 
microprocessor then compares the personal inlbrmation parameter provided in the header and the Identification number 
with the same parameter field and identiHcation number Held written from the security engine llasii memory. If both 
items match, the decryption procedure is allowed to continue. If either of the items do not match' those from the recipient 
computer, the decryption procedure i.s terminated and the data renrains encrypted. 
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Identification Over a Network: 

The present invention also allows a 'personalized' computer system that contains lliis invention to idenlily and 
authenticate another 'personalized' computer connected to it in a nctworkv In order to authenticate the identity oFa 
second computer the first computer sends an identification request through application software which operates under 
the current operating system. This identification request is encrypted by a public key algorithm then forwarded through 
the network connection to the second computer. This request contains a request for selected identification data 
parameters which can be compared witli the same parameters stored hi a database of the requesting computer system. 
These parameters can include special identification codes that are stored in tlie Application area of the smart card. Upon 
receiving this request, the identification request^ is stored in the scratch memory buffer of the security engine and 
decrypted using the same public key algorithm as in the first computer. Next, an application in the second computer calls 
the appropriate device driver w^Jiich in turn generates a Iieader containing the address oFtlie parameters requested and the 
identification task. IF data is also requested from the Application area oFthe smart card, the unique two byte code For the 
specific application and the index location of the data required must also be included in the header. This header is sent to 
the security engine microprocessor which reads the desired identification data From the personal identification look up 
table in the fiash memory and the Identical table in the internal memory oFthe smart card. The secret identification 
number also stored in the fiash memory is also read and both groups of data are written to the internal RAM oFthe 
security engine microprocesson 

Next, an encryption algorithm is used on the personal identification data to generate a hash number. The resulting hash 
number is then passed through a linear congruency function with the secret identification number creating an encrypted 
identification packet. This packet is then encrypted once more using the public key encryption algorithm. 

This encrypted identification packet is then passed back to the first computer and received by the application w^hich 
made the identification request. A call is then made to the appropriate device driver to decrypt this packet and 
authenticate the identity of the second computer. Upon receiving this call, the DDL creates a header for the packet which 
specifies the parameters For the decrypHon procedure. This header is sent along with the identification packet tJirougli 
the circular memory bulTer to the security engine microprocessor internal RAM. Using the same public key algorithm as 
was utilized by the second computer, the security engine microprocessor ofthe first computer decrypts the first layer of 
encryption ofthe identification packet. 'Fhe packet is then passed through the same linear congruency function that was 
used in the second computer, and using the secret identification number, the hash number is produced. Finally, the same 
hash number generating algorithm which was used to produce the hash number in the second computer is used to decrypt 
the hash number. This reveals the unencrypted identification parameters, 'fhe security engine microprocessor can then 
compare these parameters with those stored in the appropriate data base. If they are identicah this confirms liie idenlily 
of the second computer. 
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CLAIMS 

What is claimed is: 

1 V A computer identiUcation and security system comprising: 

a. modified motherboard 

b. modiHed BIOS for getting pre-boot control of said computer: 

G. modified DDL for controlling the encryption and decryption of all data flows; 

d. smart card system comprising smart cards and a smart card reader for identifying the user of said system . 

2. The computer security system as claimed in claim 1 , Wherein said modified motherboard comprises a means for 
controlling all the security functions of said computer; a means for enabling and disabling peripheral devices 
connected to said computer; a means for encrypting and decrypting all data moving through the Bus system. 

3. The modified motiierboard as claimed in claim 2, wherein said means for controlling the security functions of said 
computer system comprises a microprocessor based security engine embedded in said motherboard. 

4v The microprocessor based security engine as claimed In claim 3 comprising a microprocessor with internal memory; 
external scratch memory; and a programming circuit for programming the internal metnory of said security engine 
inicroproccssor. 

5. The microprocessor based security engine as claimed in claim 3, wherein said internal memory contains encryption 
algorithms comprising a first algorithm for calculating hash numbers, a second algorithm for calculating an 
encryption key to be used for communications between the security engine microprocessor and said smart card 
system, a third algorithm for encrypting all application data, a fourth algorithm Ibr altering said data, a fifth 
algorithm for encrypting data which is to be passed between computers containing this invention, and a sixth 
algoritiim for performing a check for errors in the communications between said security engine and said smart card 
reader. 

6. The modified motherboard as claimed in claim 2. wherein said means for enabling and disabling peripheral devices 
comprises a plurality of enabling and disabling circuits embedded in said motherboard and connecting said 
peripheral devices and the security engine microprocessor. 

7. The computer securily system as claimed in claim 1 , wherein said modified DDL replaces the standard DDL on the 
motherboard of said computer and which modifications comprise (he prevention of the loading of device drivers 
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unless an cUithorbJng code is present in the securit}^ engine internal memory, the interception ofall read and write 
procedures to enable liie encryption and decryption ofall data, the creation ofa header Ibr all encryption procedures 
for application data, the creation ofa header lor requesting identillcation from other computers using this invention, 
and the creation oflicadcrs for the decryption ofidcntincntion requests received Irom other computers , 

8. The modified motherboard as claimed in claim 2, wherein said means tor encrypting and decrypting all data moving 
through the computer Bus system under the control oFsaid security engine microprocessor comprises a circuit with 

a programmable device and memory buffer contiected to the computer Bus system and the security engine 
microprocessor, and a header in said memory buffer which contains all parameters for a cryptographic procedure to 
be performed. 

9. The computer security system as claimed in claim I, wherein said modified BIOS replaces the standard BIOS on the 
motherboard ofsaid computer and which modifications comprise a first function which puts the motherboard 
Central Processing Unit into an endless loop upon power on or interrupt oFthe computer and passes control to the 
security engine microprocessor until all security procedures are performed, a second function which checks For the 
presence ofa smart card upon power on, reset, or interrupt of the computer, and a third function which displays a 
security configuration set up screen and inputs user inputted data to the security engine scratch memorVv 

10. A smart card system for identifying the user ofsaid computer system as claimed in claim 1, wherein said smart card 

system comprises a smart card reader connected to the microprocessor of the security engine and a plurality of smart 
cards which contain internal memory, wherein one ofsaid plurality of smart cards is identified to be a vendor card, 
at least one oFsaid plurality of smart cards identified to be a user card, and an equal number of repair cards as user 
cards. 

1 ] - A Vendor smart card as claimed in claim 1 0, in which its internal memory is divided into two sections, a Key 
Management" Area and an Identification area, wherein a parameter which sets the ma>:inuim key length for all 
cryptographic procedures is stored in the Key Management area and which said key length parameter is passed to 
the internal memory of the security engine microprocessoi" when the vendor card is inserted Into the card reader of 
the smart card system. 

12. A repair smart card as claimed in claim 10, in which its EEPROM is divided into two sections — a Key Management 
Area and a Restricted area wherein the Restricted area contains an index oF files or directories that are to remain 
hidden when sard repair smart card is inserted in the card reader of the computer system for which it was created. 

13. A user card as claimed in claim 10, \vherein the internal memory ofsaid user smart cards is comprised ofROM and 
BEPROM in wiiich (he Iil£PROM Is divided into an (dent [Hcatioii area for storing user idcnttlTcaiion data and a 
register of smart card idenlincation codes: an Application area for the storage of data or programs by the user or 
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outside agents: and a Key Management area Tor storing hash numbers, a coninumication key for communications 
between the security engine microprocessor and the smart card, and communication keys and identillcation codes 
for any applications whicli may be stored In the Application area and the ROM rnemory contains encryption 
algorillims comprising a first algorillim for calculating hash numbers, a second algorithm for calculating an 
encryption key to be used for communications between llie security engine microprocessor and said smart card 
system, a third algorithm For encrypting all application data, a fourth algorithm for altering said data, a fifth 
algorithm for encrypting data which is to be passed between computers containing this invention, and a sixth 
algorithm for performing a check for errors in the communications between said security engine and said smart card 
reader; a look up table of commands and software which controls the security functions of the smart card. 

14, A method of controlling access to a computer system and the data contained thereof comprising: 

a. embedding a security engine comprising a microprocessor, scratch memory and a programming circuit 
connected to the secin ity engine microprocessor in the computer system niothcrboard: 

b. storing an algorithm for generating hash numbers in the internal memory of said microprocessor; 

c. embedding a plurality of enable/disable circuits, connected to the security engine microprocessor and all 
peripheral devices in said motherboard; 

d. embedding in said motherboard a memory buffer circuit comprising a programmable device and memory 
means connecting said security engine microprocessor and the ISA Bus; 

e. embedding in said motlierboard a memory buffer circuit comprising a programmable device and memory 
means connecting said security engine microprocessor and the PCI Bus; 

F, connecting to the security engine microprocessor a smart card system comprising a smart card reader and at 
least one smart card which has more than one internal memory with a first memoi-y containing an algorithm for 
creating hash numbers and a second memory having space for storing inputted data and the hash numbers 
created by (lie algorithm in the first memory; 

g. replacing the standard BIOS with a modified BIOS which contains software routines that allow for the set up of 
the security configuration of the computer system, the input of user identification data and for the security 
engine microprocessor to take control of the start up of the computer system; 

h. replacing the standard device driver layer ol'the computer system with a modified device driver iayer, in which 
the modifications comprise the prevention of the loading of device drivers unless an authorizing code is present 
in the internal memory of the security engine microprocessor, the interception of all read and write procedures 
to enable the encryption and decryption of all data, the creation ofn lieader for all encryption and decryption 
procedures for application data and the creation of a header for remote identillcation of said computer over a 
network; 

i. personalizing said computer SN'slem and nialching smart curd by storing more than one hash number generated 
from identincation infornratiou inpulied by tiie user into the internal memory of the security engine 
microprocessor and complementary hash numbers into the second memory of the smart card: 
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j. authenticating the identity oi'a user upon attempted access to said computer system; 
k. controlling access to said computer and peripheral devices; 

I. securing nil data stored in or moving through said peripheral devices through the use of cryptographic 
algorithms 

The method according to claim 14, wherein said smart cards comprises a plurality of smart cards, wherein one of 
said plurality ofsmart cards is identified to be a vendor card, at least one oFsaid plurality oF smart cards identified 
to be a user card, and an equal number oF repair cards as user cards and the Internal memory of said vendor smart 
card memory comprises a Key Management Area and an Identification area, wherein a parameter which sets the 
maximum key length for all cryptographic procedures for said computer system is stored in the Key Management 
area and which said key length parameter is passed to the internal memory oFthe security engine microprocessor 
when the vendor card is inserted into the card reader oFthe system for the first time. 

The method according to claim 14, wherein a setup routine for the personalization of said computer identification 
and security system comprises the steps of: 

a. inputting a plurality oF identification data to the scratch memory of the security engine; 

b. writing this data to the second memory of the smart card; 

c. generating more than one hash number from the inputted identification data using the algorithm stored in the 
internal memory of said security engine microprocessor with the maximum key length of said algorithm 
determined by the key length parameter passed fi-om said vendor card and stored in the internal memory of said 

security engine micj-oprocessor: 
dv burning the hash numbers to the internal memory oFthe security engine microprocessor using the programming 

circuit; 

e. generating more than one hash number in the smart card using the complementary algorithm stored in the first 

memory using ihe identification data written to the second memory of the smart card; 
F. writing the hash numbers to the second memory of the smart card microprocessor 

The method according to claim 14, wherein the authentication procedure for said computer identification and 
security system comprises the steps of: 

a. checking by the security engine microprocessor, upon power on, reset or interrupt, ihc smart card reader for a 
valid smart card; 

b. synchronizing communications between the security engine microprocessor and the valid smart card inserted in 
said smart card I'cader; 

c. reading by tlie security engine microprocessor more than one hasli number from the internal memory of the 
security engine and the complementary hash numbers from the second memory of the smart card if a valid 
smart card is inserted into the reader: 

d. placing said hash numbers in the scratch memory of the security engine; 
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L\ checking for a match between the security engine hash numbers and the smart card hash numbers using an 
nuthcnticalion algorithm: 

r. ifa match exists, reading by the BIOS tlic security configuration tor the computer, enabling all allowed 
peripheral devices, setting up cryptographic procedures for selected peripheral devices and allowing the 
loading of the computer operating system: 

g, if a match does not exist, terminating the start up procedure> 

1 8. The method according to claim 17, wherein the synchronization of communications between the sniari card and the 
security engine microprocessor further comprises the use of communication keys unique to each computer and 
matching smart card that is generated from the hash numbers stored in the internal memory of the security engine 
microprocessor and the internal memory ofsaid matching smart card, 

19. Tlie method according to claim 14, wherein the securing all data stored in or moving through said peripheral 
devices comprises the steps of: 

av intercepting all read or write procedures in the device driver layer; 

b. creating a header in the device driver which contains all the parameters required for a cryptographic procedure: 

c. sending said header through the Bus system connected to the peripheral device which is involved in the read or 
write operation to the memory buffer circuit connected to said Bus system: 

d. reading said header and the encryption parameters stored in the memory of the security engine by the security 

engine microprocessor; 

e> reading of data to be encrypted or decrypted from the memory means of the memory bulfer circuit by the 

security engine microprocessor; 
f encrypting or decrypting said data and sending the altered data back to tlie memory means of the memory 
buffer circuit; 

g. sending said altered data to the appropriate peripheral device. 

20, A method of uniquely persojiallzing a computer having a modified motherboard comprising a microprocessor based 
security engine. Flash memory In said microprocessor, scratch memory buffer in said security engine, an algorithm 
forgerierating hash numbers in the interna! memory of said microprocessor and a programming circuit" connected to 
the security engine microprocessor; a modified BIOS which contains sofiware routines that allow for the set up of 
the security configuration of the computer system, the input of user identification data and for the security engine 
microprocessor to take control of tlie start up of the computer system: atid a smart card svstejn comprisi/ig a smart 
card reader connected to said security engine microprocessor and at least one smart card which has more than one 
internal memory wiih a first memory containing an algorithm for creating fiash ruimbers which Is a derivative of the 
algorithm in the security engine and a second memory having space for storing inputted data and the hash numbers 
created by the algorithm in the first memory: comprising the steps of: 

a. inpuiting a plurality of idenlifiealion data lo tlic scratch memory of the securit}^ engine; 
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b. copying this data to the second memory of the smart card: 

generating more tlian one hash number from the inpiilted identitlcation data in tiic security engine scratch 

memory using the algorithm stored in tiic internal memory of said security engine microprocessor: 
d, translcrnng all data from the security engine microprocessor Masii memory to the memory buffer; 

burning the hash numbers and transferred data to the Mash memory of the security engine microprocessor using 

the programming circuit; 

f. generating more than one hash number in the smart card using the algorithm stored in the first memory using 
the idcntincation data copied to the second memory of the smart card; 

g. writing the hash numbers to the second memory of the smart card microprocessor. 

2K ^rhe method according to clahn 20, wliercin upon the changing of said identification data said programming circuit 
is automatically updated by the writing of this data into the second memory of the smart card inserted into the card 
reader and the tlash memory of the security engine, 

22. The method according to claim 2 1 , wherein the automatic updating ofany changed identification data to the second 
memory of the smart card and the flash memory of the security engine microprocessor comprises the steps of: 

a. Writing the contents of the security engine flash memory to the scratch memory; 

b. writing any changes made to the identification data to the identification look up table in the security engine 
scratch memory; 

c. writing any changes made to the identification data to the Identification area of the smart card internal memory; 

d. creating new hash numbers from the identification data by the smart card microprocessor; 

e. generating a new comnninication key for the smart card from (he hash numbers: 

f. creating new hash fuimbers from the identification data by the security engine microprocessor; 

g. generating a new coininunication key for the security engine from tlie hasli nunibers; 

h. burning the contents of liie scratch memory of tlie security engine to the Hash memory. 

23. A method for creating a hierarchy of subordinate computer systems in which the computer system used to create a 
subordinate system has access to said subordinate system, using more than one computer having a modified 
motherboard comprising a microprocessor based security engine. Hash memory in said microprocessor, scratch 
memory connected to said security engine, an algorithm for generating hash numbers and an algoritlim for 
generating a communication key in the mienm] memory of'snkl microprocessor nnd a programming circuit 
connected to the security engine microprocessor: a modified BIOS which contains software routines that allow^ for 
tlie set up oniie security configuration of tlie computer system, the input of user identiilcation data and for the 
security engine microprocessor to lake control of the slari up of the computer system: a smart card system 
comprising a smart card reader connected to said security engine microprocessor and an equal number of smart 
cards as computers having more than one internal memory whii a tlrst memor\' containing an algorithm Ibr creating 
hash numbers which is a derivative of the algorithm in the security engine and ti second memory having space for 
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Storing inputted data, the Iiasli numbers created by the algorithm in the Hrst memory and a smart card identification 
code, ofwhich one smart card is identilled as *used' having at least two unique hash numbers in its second memory 
and a second smart card is 'new' with no identification data or hash numbers in its internal memory; and at least one 
ofsaid computers whicii contains no identification data in its security engine memory: comprising the steps of: 

a. inserting said used smart card into the card reader oCihe computer Which has no identification data in its 
security engine memory; 

bv writing one ofsaid smart card's hash numbers to the scratch memory of the computer security engine; 

c. creating a complement ofsaid hash number; 

d. creating a communication key from said hasii number in the security engine; 

e. Writing said communication key to the security engine scratch memory; 

r. inputting identification data to the scratch memory of the security engine: 

g. inputting security conngurallon data to the scratch memory of the security engine; 

h. creating two new hash numbers from tlic identification data in the sci'atch memory of the security engine; 

L writing the CK, two new hash numbers, and identification data and security configuration to the smart card 

inserted in the smart card reader^ 
j. ejecting the used smart card from the reader; 
k. inserting a new smart card into tJie reader; 

k writing to said new smart card an Identification code which identifies it as part of a subordinate system; 
m. writing the hash number complement, identification data and security configuration to the new smart card; 
n. calculating two new hash nijj7iber$, in ihe smart card, from the identification data: 
0* creating a complement of the two hash numbers: 

p. calculating a communication key from the complement of the hash number coinplenient passed from ihe 'used' 
smart card; 

q. waiting the complement of the new hash numbers and the complement of the hash number passed from the 
'used' smart card, and the communication key calculated by the new smart card to the internal memory of the 
new smart card; 

i\ writing all data in the security engine Hash memory to the scratch memory: 

s* burning the contents of the scratch memory to the security engine tlasii memory. 

24. A method of identifying and authenliicnting, over a network, a uniquely personalized computer having a modified 
motherlioard comprising a microprocessoi^ based security engine. Hash memory in said microprocessor, a look up 
table of personal identification data, a secret identification numbei- which is the same for all computers containing 
this invention, in said ilash nieinory: scratch memory in said security engine; an algorithm for generating hash 
numbers, a linear congruency function and a public key encryption algorithm in the internal memors^ oi' said 
microprocessor: a modified DDL that allows for the creation of headers: and a smart card system comprising a 
smart card reader connected to said security engine microprocessor and a personalized smart card which has internal 
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mctnory with nn Identification area for storing personal identiUcation data and an Application area (or storing 
external appHcnlions and an index for the location and idcntillcation codes for each application; and a data base of 
personal identiilcation data fbr other personalized compuiers comprising the steps of: 

a. a Ilrst personalized computer requesting identiHcation through an application from a second personalized 
computer over a network comprising selected identification data irom the second computer's idcntiHcalion data 
look up table and select information From the second computer's smart card; 

b. a device driver in the second computer generating a header comprised of the ideniincation task, the addresses 
oFthe identification parameters requested and the two byte code For any smart card application from which data 
is required and the location of said data; 

c. sending this iieader to tlie security engine microprocessor; 

d. reading of the idcntincation data from the look up table in said security engine microprocessor Hash memory; 

e. reading of the identiiication data from the look up table of the internal memory oFthe smart card inserted in the 
smart card reader; 

f writing the retrieved identification data to the internal memory oFthe security engine microprocessor; 
g. generating a hash number from the identification data stored in said internal memory; 

h passing said hash number through a linear congruency function using the secret identification number stored in 
flash memoiy: 

i. encrypting the resultant number with the public key algorithm; 
j, sending the encrypted data to the first computer; 

k. the receiving application of the first computer calling a device driver to decrypt the data; 
1. the device driver creating a header comprising the parameters For the decryption procedure; 
m. sending this header with the enciypted data to the internal memory oFthe first computer's security engine 
microprocessor; 

n. decrypting the data using the public key algorithm stored in the flash memory oFthe first computer; 

o> passing the resultant data Ihrongli the linear congruency Function to produce the bash number generated by the 
second computer and the secret identification number; 

p, decrypting the hash number using the hash number generating algorithm stored in the flash memory oFthe first- 
computer; 

q. comparing the identificntion data with that stored in the data base; 
r. confirming the identity oFthc second computer if the data matches. 
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